Merge pull request #13 from jxs/bugfix/api-http-auth

fix bug on api.rs, only insert username in the session if authentication was successful

src/api.rs

@@ -237,11 +237,13 @@ impl Handler for AuthHandler {
 					if let Some(ref password) = auth.password {
 						auth_success =
 							user::auth(self.db.deref(), auth.username.as_str(), password.as_str())?;
+						if auth_success {
 							req.extensions
 								.insert::<SessionKey>(Session { username: auth.username.clone() });
 						}
 					}
 				}
+			}
 
 			// Auth via Session
 			if !auth_success {