code: func (s *AuthServer) AuthenticateWebUser(req AuthenticateUserRequest) (services.WebSession, error) {
  	if req.Session != nil {
  		session, err := s.GetWebSession(req.Username, req.Session.ID)
  		if err != nil {
  			return nil, trace.AccessDenied("session is invalid or has expired")
  		}
  		return session, nil
  	}
  	if err := s.AuthenticateUser(req); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	sess, err := s.NewWebSession(req.Username)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	if err := s.UpsertWebSession(req.Username, sess); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	sess, err = services.GetWebSessionMarshaler().GenerateWebSession(sess)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return sess, nil
  }
docs: // AuthenticateWebUser authenticates web user, creates and  returns web session
  // in case if authentication is successful. In case if existing session id
  // is used to authenticate, returns session associated with the existing session id
  // instead of creating the new one