function user:login_session(username, password)
    local s = o3cms.session
    if cookie_valid(s) then
        local u,t = user:find_by_crypt(username, password), nil
        if nil ~= u then
            u.session = s
            u:save()
        else
            repeat
                t = string.random(6, "ABCDEF%d")
                u = user:find_by_tripcode(t)
            until nil == u
            u = user:new()
            session_message("u0:"..(u.id or "nil"))
            u.id = nil
            if (nil == u.id) then
                u.username = username
                u.password = user:crypt(username, password)
                u.tripcode = t
                u.session = s
                u:save(true)
                session_message("u1:"..(u.id or "nil"))
            else
                session_message("u2:"..json.encode(u))
            end
        end
        o3cms.user = u
    else
        o3cms.user = nil
    end
end