def login(self, user, remember=True, session=None):
        """Sets the current user UID in the session.

        Instead of just storing the user's id, it generates a hash from the
        password *salt*. That way, an admin or the user herself can invalidate
        the login in other computers just by changing (or re-saving)
        her password.

        """
        logger = logging.getLogger(__name__)
        logger.debug(u'User `{0}` logged in'.format(user.login))
        if session is None:
            session = self.session
        session['permanent'] = remember
        session[self.session_key] = user.get_uhmac()
        if callable(getattr(session, 'save', None)):
            session.save()