--- a/server/repository.py	Tue May 05 17:13:30 2009 +0200
+++ b/server/repository.py	Tue May 05 17:13:37 2009 +0200
@@ -497,6 +497,7 @@
         given password. This method is designed to be used for anonymous
         registration on public web site.
         """
+        # XXX should not be called from web interface
         session = self.internal_session()
         # for consistency, keep same error as unique check hook (although not required)
         errmsg = session._('the value "%s" is already used, use another one')

--- a/web/views/authentication.py	Tue May 05 17:13:30 2009 +0200
+++ b/web/views/authentication.py	Tue May 05 17:13:37 2009 +0200
@@ -53,11 +53,15 @@
         return cnx
 
     def login_from_email(self, login):
+        # XXX should not be called from web interface
         session = self.repo.internal_session()
-        rset = session.execute('Any L WHERE U login L, U primary_email M, '
-                               'M address %(login)s', {'login': login})
-        if rset.rowcount == 1:
-            login = rset[0][0]
+        try:
+            rset = session.execute('Any L WHERE U login L, U primary_email M, '
+                                   'M address %(login)s', {'login': login})
+            if rset.rowcount == 1:
+                login = rset[0][0]
+        finally:
+            session.close()
         return login
 
     def authenticate(self, req, _login=None, _password=None):