Implement login.
Implement User::fromSession().
Hash User passwords before saving them.
Remove unnecessary ?><?php tokens.
Implement User::isAdmin().
Implement UserController and update action.