def self.authenticate(login, password)
    return nil if login.blank? or password.blank?
    
    # need to get the salt
    if login.match("@")
      user = find_in_state :first, :active, :conditions => { :email => login}
    else
      user = find_in_state :first, :active, :conditions => { :login => login}
    end
    
    user && user.authenticated?(password) ? user : nil
  end