def verify_password(username_or_token, password):
# first try to authenticate by token
user = UserModel.verify_auth_token(username_or_token)
if not user:
# Second try to authenticate by login credentials
user = UserModel.get_by_email(username_or_token)
if not user or not user.verify_password(password):
return False
g.user = user
return True
