A junior developer submitted this pull request. Write code review comments that are: - Technically accurate - Educational (helps them learn, not just tells them what's wrong) - Kind but honest - Actionable ```python # PR: Add user authentication def login(user, pw): # get user from db u = db.query(f"SELECT * FROM users WHERE name='{user}'") if u == None: return False # check pw if u.password == pw: session['user'] = u.name session['admin'] = True # give admin access return True return False def is_admin(user): return session.get('admin', False) ```