I quick scan of Auth.pm earlier today made me think we needlessly look up the user form the database multiple times. We should be able to perform that lookup once and then reuse the object throughout the r of the process.