User.authenticate returns the admin user