The same code for login exists in both the user/create and session/create methods. Can we split that out into a function maybe?