public function signInUser(UserInterface $user, $strategy = 'web', $remember = false)
    {
        // sign in the user with the session storage
        $storage = $this->getStorage();
        $result = $storage->signIn($user,
                                   $this->request,
                                   $this->response);

        if (!$result) {
            throw new AuthException('Could not sign in user');
        }

        // if a user needs 2FA verification then they cannot
        // be completely signed in until they verify using 2FA
        $twoFactor = $this->getTwoFactorStrategy();
        if ($twoFactor && !$user->isTwoFactorVerified() && $twoFactor->needsVerification($user)) {
            $this->setCurrentUser($user);

            return $user->markSignedOut();
        }

        // use a remember me session (lasts longer)
        if ($remember) {
            $result = $storage->remember($user,
                                         $this->request,
                                         $this->response);

            if (!$result) {
                throw new AuthException('Could not enable remember me for user session');
            }
        }

        if ($user->id() > 0) {
            // mark the user model as signed in
            $user->markSignedIn();

            // record the login event
            $event = new AccountSecurityEvent();
            $event->user_id = $user->id();
            $event->type = AccountSecurityEvent::LOGIN;
            $event->ip = $this->request->ip();
            $event->user_agent = $this->request->agent();
            $event->auth_strategy = $strategy;
            $event->save();
        } else {
            // mark the user model as not signed in since this user
            // is a guest of some sort
            $user->markSignedOut();
        }

        $this->setCurrentUser($user);

        return $user;
    }