login: function (req, res) {
    var username = req.param("username");
    var password = req.param("password");

    Users.findOneByUsername(username).done(function(err, usr){
      if(err) {
        res.send(500, {error: "DB Error"});
      } else {
        if (usr) {
          var hasher = require("password-hash");
          if (hasher.verify(password, usr.password)) {
            req.session.user = usr;
            res.send(usr);
          } else {
           res.send(404,{ error: "Wrong password "});
          return res.badRequest(
   'wrong password.'
 );
          }
        }
        else {

         res.notFound();
         res.send( 404,{ error: 'User not found '});

        }
      }
    });
  },