fake `sign_in`, store user in model