if remember:

            _year = (datetime.datetime.now() +

                     datetime.timedelta(seconds=60 * 60 * 24 * 365))

            session._set_cookie_expires(_year)

        session.save()

        log.info('user %s is now authenticated and stored in '

                 'session, session attrs %s' % (username, cs))

        # dumps session attrs back to cookie

        session._update_cookie_out()

    def _validate_came_from(self, came_from):

        """Return True if came_from is valid and can and should be used"""

        if not came_from:

            return False

        parsed = urlparse.urlparse(came_from)

        server_parsed = urlparse.urlparse(url.current())

        allowed_schemes = ['http', 'https']

        if parsed.scheme and parsed.scheme not in allowed_schemes:

            log.error('Suspicious URL scheme detected %s for url %s' %

                     (parsed.scheme, parsed))

            return False

        if server_parsed.netloc != parsed.netloc:

            log.error('Suspicious NETLOC detected %s for url %s server url '

                      'is: %s' % (parsed.netloc, parsed, server_parsed))

            return False

        return True

        '''redirect to the original page, preserving any get arguments given'''

        request.GET.pop('came_from', None)

    def index(self):

        c.came_from = safe_str(request.GET.get('came_from', ''))

        if not self._validate_came_from(c.came_from):

            c.came_from = url('home')

        not_default = self.authuser.username != User.DEFAULT_USER

        ip_allowed = self.authuser.ip_allowed

        # redirect if already logged in

        if self.authuser.is_authenticated and not_default and ip_allowed:

            return self._redirect_to_origin(c.came_from)

        if request.POST:

            # import Login Form validator class

            login_form = LoginForm()

            try:

                session.invalidate()

                c.form_result = login_form.to_python(dict(request.POST))

                # form checks for username/password, now we're authenticated

                                        username=c.form_result['username'],

                                        remember=c.form_result['remember'])

            except formencode.Invalid, errors:

                defaults = errors.value

                # remove password from filling in form again

                del defaults['password']

                return htmlfill.render(

                    render('/login.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

        auth_plugins = Setting.get_auth_plugins()

        if any((importplugin(name).is_container_auth for name in auth_plugins)):

            from kallithea.lib import auth_modules

            try:

                auth_info = auth_modules.authenticate('', '', request.environ)

            except UserCreationError, e:

                log.error(e)

                h.flash(e, 'error')

                # render login, with flash message about limit

                return render('/login.html')

            if auth_info:

        return render('/login.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate',

                               'hg.register.manual_activate')

    def register(self):

        c.auto_active = 'hg.register.auto_activate' in User.get_default_user()\

            .AuthUser.permissions['global']

        settings = Setting.get_app_settings()

        captcha_private_key = settings.get('captcha_private_key')

        c.captcha_active = bool(captcha_private_key)