protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        HttpSession httpSession = request.getSession();
        Session session = HibernateUtil.getSessionFactory().getCurrentSession();
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        String queryString = "from User where username = :username and password = :password";
        String url, message = "";
        Query query;


        User user =(User) httpSession.getAttribute("user");
        if(user == null){
            user = new User();
        }

        try {
            session.beginTransaction();


            query = session.createQuery(queryString);
            query.setString("password", password);
            query.setString("username", username);
            Object queryResult = query.uniqueResult();
            User tmpUser = (User) queryResult;



            if (tmpUser != null) {
                user = tmpUser;
                url = "/welcome.jsp";
            } else {
                message = "invalid username or password";
                user.addLogAttempt();
                if (user.getLoginAttempts() > 2) {
                    url = "/addUser.jsp";
                } else {
                    url = "/index.jsp";
                }
            }
            httpSession.setAttribute("user", user);
            httpSession.setAttribute("message", message);
            /* User user = new User();
            user.setUsername("ryanggfx2");
            user.setEmailAddress("ryanggfx2@gmail.com");
            user.setPassword("ryanggfx2");
             */
            session.getTransaction().commit();

        } catch (Exception e) {
           url = "/error.jsp";
           request.setAttribute("error", e);
       } finally {
        }

        RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(url);
        dispatcher.forward(request, response);
    }