diff --git a/app.moon b/app.moon
index 42fbe44..fd59960 100644
--- a/app.moon
+++ b/app.moon
@@ -7,9 +7,7 @@ import capture_errors from require "lapis.application"
 import assert_valid from require "lapis.validate"
 import respond_to from require "lapis.application"
 
-import Model from require "lapis.db.model"
-
-class Users extends Model
+require "models.user"
 
 class App extends lapis.Application
   "/": =>
@@ -38,6 +36,7 @@ class App extends lapis.Application
         return "User with that email already exists"
 
       user = Users\create @params
+      user\write_session @
 
       "Hi " .. user.name
   }
@@ -55,4 +54,13 @@ class App extends lapis.Application
       }
 
       user = Users\find email: @params.email
+
+      cmppass = encoding.encode_base64 encoding.hmac_sha1("ninjas", @params.password)
+
+      if user.password == cmppass
+        user\write_session @
+
+        return "Hi " .. user.name
+      else
+        return status: 500, "bad password"
   }
diff --git a/models/user.moon b/models/user.moon
new file mode 100644
index 0000000..07e3a66
--- /dev/null
+++ b/models/user.moon
@@ -0,0 +1,8 @@
+db = require "lapis.db"
+import Model from require "lapis.db.model"
+
+export class Users extends Model
+  @timestamp: true
+
+  write_session: (r) =>
+    r.session.user = @id