code: func (a *AuthServer) createUserAndSession(stoken *services.SignupToken) (services.WebSession, error) {
  	// extract user from signup token. if no roles have been passed along, create
  	// user with default role. note: during the conversion from services.UserV1
  	// to services.UserV2 we convert allowed logins to traits.
  	user := stoken.User.V2()
  	if len(user.GetRoles()) == 0 {
  		user.SetRoles([]string{teleport.AdminRoleName})
  	}
  
  	// upsert user into the backend
  	err := a.UpsertUser(user)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	log.Infof("[AUTH] Created user: %v", user)
  
  	// remove the token once the user has been created
  	err = a.DeleteSignupToken(stoken.Token)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	// create and upsert a new web session into the backend
  	sess, err := a.NewWebSession(user.GetName())
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	err = a.UpsertWebSession(user.GetName(), sess)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return sess, nil
  }
docs: // createUserAndSession takes a signup token and creates services.User (either
  // with the passed in roles, or if no role, the default role) and
  // services.WebSession in the backend and returns the new services.WebSession.