"Set-Cookie: session=%s; max-age=3600; http-only\r\n"  // Session ID

			"Set-Cookie: user=%s\r\n"  // Set user, needed by Javascript code

			"Set-Cookie: admin=%s\r\n"  // Set user, needed by Javascript code

			"Set-Cookie: base_location=%s\r\n"  // Set user, needed by Javascript code

			"Set-Cookie: original_url=/; max-age=0\r\n"  // Delete original_url

			"Location: %s%sinstances\r\n\r\n",

			session->session_id, session->user, session->admin ? "1" : "0", CONFIG_STRING(m_config, "service.base_location").c_str(), host.c_str(), CONFIG_STRING(m_config, "service.base_location").c_str());

	} else {

		// Authentication failure, redirect to login.

		redirect_to(conn, hm, "/login");

	}

}

bool Server::is_authorized(const struct mg_connection *conn, struct http_message *hm) {

	Server::session *session;

	char valid_id[33];

	bool authorized = false;

	// Always authorize accesses to login page and to authorize URI

	if (!mg_vcmp(&hm->uri, "/login") ||

		!mg_vcmp(&hm->uri, "/login/") ||

		!mg_vcmp(&hm->uri, "/form.css") ||

		!mg_vcmp(&hm->uri, "/style.css") ||

		!mg_vcmp(&hm->uri, "/logo.png") ||

		!mg_vcmp(&hm->uri, "/authorize")) {

		return true;

	}

	if ((session = get_session(hm)) != NULL) {

		generate_session_id(valid_id, session->random, session->user);

		if (strcmp(valid_id, session->session_id) == 0) {

			session->expire = time(0) + SESSION_TTL;

			authorized = true;

		}

	}

	return authorized;

}

void Server::redirect_to(struct mg_connection *conn, struct http_message *hm, const char *where) {

	std::string host;

	mg_str *host_hdr = mg_get_http_header(hm, "Host");

	if (host_hdr) {

		if (!CONFIG_STRING(m_config, "service.cert").empty()) {

			host += "https://";

		}

		else {

			host += "http://";