     |> redirect(to: page_path(conn, :index))
   end
 
-  defp sign_in(user, _, conn) when is_nil(user) do
-    conn
-    |> put_flash(:error, "Invalid username/password combination!")
-    |> redirect(to: page_path(conn, :index))
+  defp sign_in(user, _password, conn) when is_nil(user) do
+    failed_login(conn)
   end
 
   defp sign_in(user, password, conn) do

defmodule TheJuice.SessionController do
  use TheJuice.Web, :controller
  alias TheJuice.User
  import Comeonin.Bcrypt, only: [checkpw: 2]

  plug :scrub_params, "user" when action in [:create]


      |> put_flash(:info, "Sign in successful!")
      |> redirect(to: page_path(conn, :index))
    else
      failed_login(conn)
    end
  end

  defp failed_login(conn) do
    # Call dummy_checkpw so hackers can't iterate through usernames with
    # bad passwords and check to see if timing changes when username doesn't
    # exist in our system.
    dummy_checkpw()
    conn
    |> put_session(:current_user, nil)
    |> put_flash(:error, "Invalid username/password combination!")
    |> redirect(to: page_path(conn, :index))
    |> halt()
  end
end
