Data Mapper pattern: where to put a checkLogin method for a User Model?

I'm trying to implement the data mapper pattern for a User Class.

If I understood correctly, the business class User shouldn't call any persistence methods, instead, it's dropped into the Data Mapper class (UserMapper) and the mapper interfaces with the database, ideally using a table gateway class.

I have some questions:

1. 
   

   Where would I put a checkLogin method? User or UserMapper? I need to check the login status of current visitor by his cookie. Since User cant reference the database and session data is stored there I have to use the mapper class right?

   
   


2. 
   

   Where do I put the validation rules? I wanted to put them in the User class so that when I instantiate it, I would get an exception if the data is wrong. However I would need validation rules on the mapper for methods like checkLogin() and others. Maybe I shouldn't instantiate new User() directly, instead, I should create a new user from the data mapper where the validation rules would also be stored. What do you think?

   
   


3. 
   

   It seems that this way, I end up with a very small model class and a bigger data mapper class. But since most of my application is database interaction I suppose this isn't that bad. Is it a code smell or not?

   
   

Thanks.