code: func (h *Handler) createSessionWithU2FSignResponse(w http.ResponseWriter, r *http.Request, p httprouter.Params) (interface{}, error) {
  	var req *u2fSignResponseReq
  	if err := httplib.ReadJSON(r, &req); err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	sess, err := h.auth.AuthWithU2FSignResponse(req.User, &req.U2FSignResponse)
  	if err != nil {
  		return nil, trace.AccessDenied("bad auth credentials")
  	}
  	if err := SetSession(w, req.User, sess.GetName()); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	ctx, err := h.auth.ValidateSession(req.User, sess.GetName())
  	if err != nil {
  		return nil, trace.AccessDenied("need auth")
  	}
  	return NewSessionResponse(ctx)
  }
docs: // createSessionWithU2FSignResponse is called to sign in with a U2F signature
  //
  // POST /webapi/u2f/session
  //
  // {"user": "alex", "u2f_sign_response": { "signatureData": "signatureinbase64", "clientData": "verylongbase64string", "challenge": "randombase64string" }}
  //
  // Successful response:
  //
  // {"type": "bearer", "token": "bearer token", "user": {"name": "alex", "allowed_logins": ["admin", "bob"]}, "expires_in": 20}
  //