Determines if a URI reference is valid and relative to the origin;

        or in RFC 3986 terms, whether it matches this production:

          origin-relative-ref = path-absolute [ "?" query ] [ "#" fragment ]

        with the exception that '%' escapes are not validated and '#' is

        allowed inside the fragment part.

        """

        return _re.match(came_from) is not None

    def index(self):

        c.came_from = request.GET.get('came_from', '')

        if c.came_from:

            if not self._validate_came_from(c.came_from):

                log.error('Invalid came_from (not server-relative): %r', c.came_from)

                raise HTTPBadRequest()

        else:

            c.came_from = url('home')

        if request.POST:

            # import Login Form validator class

            login_form = LoginForm()()

            try:

                c.form_result = login_form.to_python(dict(request.POST))

                username = c.form_result['username']

                user = User.get_by_username_or_email(username)

                assert user is not None  # the same user get just passed in the form validation

            except formencode.Invalid as errors:

                defaults = errors.value

                # remove password from filling in form again

                defaults.pop('password', None)

                return htmlfill.render(

                    render('/login.html'),

                    defaults=errors.value,

                    errors=errors.error_dict or {},

                    prefix_error=False,

                    encoding="UTF-8",

                    force_defaults=False)

            except UserCreationError as e:

                # container auth or other auth functions that create users on

                # the fly can throw this exception signaling that there's issue

                # with user creation, explanation should be provided in

                # Exception itself

                h.flash(e, 'error')

            else:

                auth_user = log_in_user(user, c.form_result['remember'], is_external_auth=False, ip_addr=request.ip_addr)

                if auth_user:

                    raise HTTPFound(location=c.came_from)

                h.flash(_('Authentication failed.'), 'error')

        else:

            # redirect if already logged in

            if not request.authuser.is_anonymous:

                raise HTTPFound(location=c.came_from)

            # continue to show login to default user

        return render('/login.html')

    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate',

                               'hg.register.manual_activate')

    def register(self):

        def_user_perms = AuthUser(dbuser=User.get_default_user()).permissions['global']

        c.auto_active = 'hg.register.auto_activate' in def_user_perms

        settings = Setting.get_app_settings()

        captcha_private_key = settings.get('captcha_private_key')

        c.captcha_active = bool(captcha_private_key)

        c.captcha_public_key = settings.get('captcha_public_key')

        if request.POST: