docs: def login(self, user, remember=True, session=None):
          """Sets the current user UID in the session.
  
          Instead of just storing the user's id, it generates a hash from the
          password *salt*. That way, an admin or the user herself can invalidate
          the login in other computers just by changing (or re-saving)
          her password.
  
          """
          logger = logging.getLogger(__name__)
          logger.debug(u'User `{0}` logged in'.format(user.login))
          if session is None:
              session = self.session
          session['permanent'] = remember
          session[self.session_key] = user.get_uhmac()
          if callable(getattr(session, 'save', None)):
              session.save()