It may be worth putting a `User.login` class method to find by username/validate the password, thus turning this into a single line.

Alternatively a sessions_helper would be cool.