User.authenticate_signin takes a Session arg.