public static function login($user, $sendAuthHeader) {
    if (isset($user->guid) && $user->enabled) {
      $token = self::$config['jwt_builder']($user);
      $appUrlParts = parse_url(self::$config['app_url']);
      setcookie(
          'TILMELDAUTH',
          $token,
          time() + self::$config['jwt_expire'],
          $appUrlParts['path'],
          $appUrlParts['host'],
          $appUrlParts['scheme'] === 'https',
          false // Allow JS access (for CSRF protection).
      );
      if ($sendAuthHeader) {
        header("X-TILMELDAUTH: $token");
      }
      self::fillSession($user);
      return true;
    }
    return false;
  }