  def self.loginByPassword(session, username, password)
    if validUser(username, password)
      session[:username] = username
      success, groups = getUsersGroups(username)
      session[:usergroups] = success ? groups : []
      return true
    end
    return false
  end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.