auth: move UserModel.fill_data to AuthUser

Because the method is only used by AuthUser, and also because it's an
awful thing to do (copying a large but ill-defined set of attributes
from one object to another), and we don't want usage to spread.