You must call authenticate before you can call login. authenticate sets an attribute on the object noting which backend has successfully validated it and clearing it for login, which isn’t happening in your code (and that’s the attribute that is missing).
Documentation: https://docs.djangoproject.com/en/1.8/topics/auth/default/#how-to-log-a-user-in — check out the little callout that says “calling authenticate() first”.