The first param provided in Wordpress' authenticate filter may be of type null|WP_User|WP_Error. Function check_active_user runs into an error when accessing $user->ID if the provided param is not of type WP_User.