*/
public Session buildSession(UserDAO userDAO) throws WebApplicationException {
final User user = userDAO.findById(username);
if (user != null) {
try {
final UnlockedKeySet keySet = user.getKeySet().unlock(password.toCharArray());
return new Session(user, keySet);
} catch (CryptographicException e) {
throw new WebApplicationException(CHALLENGE);
}
}