docs: def login(request, user):
      """
      Persist a user id and a backend in the request. This way a user doesn't
      have to reauthenticate on every request. Note that data set during
      the anonymous session is retained when the user logs in.
      """
      session_auth_hash = ''
      if user is None:
          user = request.user
      if hasattr(user, 'get_session_auth_hash'):
          session_auth_hash = user.get_session_auth_hash()
  
      if SESSION_KEY in request.session:
          session_key = request.session[SESSION_KEY]
          if session_key != user.pk or (
                  session_auth_hash and
                  request.session.get(HASH_SESSION_KEY) != session_auth_hash):
              # To avoid reusing another user's session, create a new, empty
              # session if the existing session corresponds to a different
              # authenticated user.
              request.session.flush()
      else:
          request.session.cycle_key()
      request.session[SESSION_KEY] = user.pk
      request.session[BACKEND_SESSION_KEY] = user.backend
      request.session[USER_DATA_SESSION_KEY] = user.user_data
      request.session[HASH_SESSION_KEY] = session_auth_hash
  
      update_token_in_session(request.session, user.token)
  
      if hasattr(request, 'user'):
          request.user = user
      rotate_token(request)
      user_logged_in.send(sender=user.__class__, request=request, user=user)