Only use authenticate_user where it is needed