def create
    # Workaround for lack of browser support for the formaction attribute.
    return reset_password if params[:reset_password]

    @redirect_url = params[:redirect_url] || session_url
    @session = Session.from_params params
    auth = User.authenticate_signin @session
    unless auth.kind_of? Symbol
      set_session_current_user auth
      Tokens::SessionUid.remove_expired if auto_purge_sessions
    end

    respond_to do |format|
      if current_user
        format.html { redirect_to @redirect_url }
        format.json do
          user_data = current_user.as_json
          if current_user.class.include_root_in_json
            user_data = user_data['user']
          end
          render json: { user: user_data, csrf: form_authenticity_token }
        end
      else
        error_text = bounce_notice_text auth
        format.html do
          if params[:redirect_url]
            redirect_to new_session_url, flash: { alert: error_text,
                auth_redirect_url: @redirect_url }
          else
            redirect_to new_session_url, alert: error_text
          end
        end
        format.json { render json: { error: auth, text: error_text } }
      end
    end
  end
def create
    # Workaround for lack of browser support for the formaction attribute.
    return reset_password if params[:reset_password]

    @redirect_url = params[:redirect_url] || session_url
    @session = Session.from_params params
    auth = User.authenticate_signin @session
    unless auth.kind_of? Symbol
      set_session_current_user auth
      Tokens::SessionUid.remove_expired if auto_purge_sessions
    end

    respond_to do |format|
      if current_user
        format.html { redirect_to @redirect_url }
        format.json do
          user_data = current_user.as_json
          if current_user.class.include_root_in_json
            user_data = user_data['user']
          end
          render json: { user: user_data, csrf: form_authenticity_token }
        end
      else
        error_text = bounce_notice_text auth
        format.html do
          if params[:redirect_url]
            redirect_to new_session_url, flash: { alert: error_text,
                auth_redirect_url: @redirect_url }
          else
            redirect_to new_session_url, alert: error_text
          end
        end
        format.json { render json: { error: auth, text: error_text } }
      end
    end
  end
POST /session