api.post('/users/login', function(req, res, next) {
    var up = new providers.User(db, req, res);
    up.login({
        username: req.body['username'],
        password: req.body['password']
    }, function() {
        res.succeed();
    });
});

UserProvider.prototype.login = function(values, callback) {
    var self = this,
      login_token = make_login_token(values.username);
    self.mysql.query('SELECT * FROM `users` WHERE `username` = ? AND `password` = ? LIMIT 1', [values.username, sha1(values.password)], function(err, results, fields) {
        if (err) { throw err; }
        if(!results.length) {
          self.res.payload.errors.push('incorrect username or password');
      }
      self.res.failsafe(200, function() {
        self.res.payload.user = {
                login_token: results[0].login_token
          }
          callback.call(self);
      });
    });
}