Doesn't `has_secure_password` generate the `authenticate` method for free? If so, you don't need to define it yourself.