views.py

class SigninSchema(colander.MappingSchema):
    username = colander.SchemaNode(colander.String())
    password = colander.SchemaNode(colander.String(), widget=widget.PasswordWidget())

    def validator(self, node, data):
        user = DBSession.query(User).filter_by(username = data['username']).first()
        if user is None:
            self.raise_invalid('Incorrect username', node['username'])
        if not user.check_password(data['password']):
            self.raise_invalid('Incorrect password', node['password'])
        data['user_object'] = user

@view_config(route_name='signin', renderer='potterholics:templates/signin.mako')
def signin(request):
    schema = SigninSchema()
    form = Form(schema, buttons=('signin',))

    if request.method == 'POST':
        controls = request.POST.items()
        try:
            data = form.validate(controls)
        except ValidationFailure, e:
            pass
        else:
            user = data['user_object']
    return {'form': form}