auth: inline AuthUser.set_authenticated

This makes the following commits easier to follow, and makes it more
explicit that something weird is going on, with more cleanup needed.