backend.  This removes the need for the hack setting user.backend 
manually and lets dependent code use the standard authenticate() method.