diff --git a/src/lib/Application.php b/src/lib/Application.php
index a21eb442b3..158d3d23ac 100644
--- a/src/lib/Application.php
+++ b/src/lib/Application.php
@@ -42,19 +42,24 @@ final class Application extends Base
 	/**
 	 *
 	 */
-	function getCurrentUser()
+	function __get($name)
 	{
-		return isset($_SESSION['user']['name'])
-			? $_SESSION['user']['name']
-			: false;
+		if ($name === 'xo')
+		{
+			return $this->_di->get('xo');
+		}
+
+		parent::__get($name);
 	}
 
 	/**
 	 *
 	 */
-	function getVms()
+	function getCurrentUser()
 	{
-		return $this->_di->get('xo')->vm->getAll();
+		return isset($_SESSION['user']['name'])
+			? $_SESSION['user']['name']
+			: false;
 	}
 
 	/**
@@ -75,12 +80,18 @@ final class Application extends Base
 	{
 		$xo = $this->_di->get('xo');
 
-		if (!$xo->session->logIn($name, $password))
+		try
+		{
+			$xo->session->signInWithPassword($name, $password);
+		}
+		catch (XO_Exception $xo)
 		{
 			return false;
 		}
-		$_SESSION['user']['name']     = $name;
-		$_SESSION['user']['password'] = $password;
+
+		$user = $xo->session->getUser();
+		$user['token'] = $xo->session->createToken();
+		$_SESSION['user'] = $user;
 
 		return true;
 	}
diff --git a/src/lib/DI.php b/src/lib/DI.php
index 4b240d3f79..77967dcbfb 100644
--- a/src/lib/DI.php
+++ b/src/lib/DI.php
@@ -126,15 +126,9 @@ final class DI extends Base
 	{
 		$xo = new XO($this->get('config')->get('xo.url'));
 
-		if (isset(
-			$_SESSION['user']['name'],
-			$_SESSION['user']['password']
-		))
+		if (isset($_SESSION['user']['token']))
 		{
-			$xo->session->logIn(
-				$_SESSION['user']['name'],
-				$_SESSION['user']['password']
-			);
+			$xo->session->signInWithToken($_SESSION['user']['token']);
 		}
 
 		return $xo;
diff --git a/src/templates/admin/_base.html b/src/templates/admin/_base.html
index c3c2029f74..de7e327aee 100644
--- a/src/templates/admin/_base.html
+++ b/src/templates/admin/_base.html
@@ -32,7 +32,7 @@
 				<li class="nav-header">Admin Panel</li>
 				<li {if $dashboard}class="active"{/if}><a href="admin.php">Dashboard</a></li>
 				<li class="nav-header">Security</li>
-				<li {if $users}class="active"{/if}><a href="users.php">Users</a></li>
+				<li {if $menu_admin_users}class="active"{/if}><a href="users.php">Users</a></li>
 				<li {if $groups}class="active"{/if}><a href="groups.php">Groups</a></li>
 				<li {if $policies}class="active"{/if}><a href="policies.php">Policies</a></li>
 				<li class="nav-header">XCP settings</li>
diff --git a/src/templates/admin/users.html b/src/templates/admin/users.html
index 08ddede8aa..6cd2985b88 100644
--- a/src/templates/admin/users.html
+++ b/src/templates/admin/users.html
@@ -25,8 +25,47 @@
 
 {block content}
 	<div class="span8 well">
-		<h3 class="center">Users</h3>
-		<p class="center">Here admin of Users</p>
+		<h2 class="center">Users</h2>
+
+<h3>Existing</h3>
+<table class="table table-striped table-bordered table-hover table-condensed">
+	<thead>
+		<tr>
+			<th>Name</th>
+			<th>Permission</th>
+			<th>Delete?</th>
+		</tr>
+	</thead>
+	<tbody>
+		{foreach $users as $user_}
+		<tr>
+			<td>{$user_.name}</td>
+			<td>{$user_.permission}</td>
+			<td>
+				<a href="?a=delete&id={$user_.id}" class="text-error" title="Delete this user." data-confirm="Are you sure you want to delete “{$user_.name}”?">
+					<i class="icon-trash"></i>
+				</a>
+			</td>
+		</tr>
+		{/foreach}
+	</tbody>
+</table>
+
+<h3>Create</h3>
+<form action="?a=create" method="post" autocomplete="off">
+	<div class="input-prepend">
+		<span class="add-on"><i class="icon-user"></i></span>
+		<input class="span2" type="text" placeholder="User" name="name">
+	</div>
+	<div class="input-prepend">
+		<span class="add-on"><i class="icon-key"></i></span>
+		<input class="span2" type="password" placeholder="Password" name="password" />
+	</div>
+	<button type="submit" class="btn btn-primary">
+		<i class="icon-plus"></i> Create user
+	</button>
+</form>
+
 	</div>
 {/block content}
 
diff --git a/src/www/getAll.php b/src/www/getAll.php
index cb8c12d697..1ac6d8c5b1 100644
--- a/src/www/getAll.php
+++ b/src/www/getAll.php
@@ -23,7 +23,7 @@
  */
 $application = require(__DIR__.'/../bootstrap.php');
 
-$vms = $application->getVms();
+$vms = $application->xo->vm->getAll();
 
 $keys = array(
 	'uuid',
diff --git a/src/www/js/xo.js b/src/www/js/xo.js
index c0c92148ea..4e77e14230 100644
--- a/src/www/js/xo.js
+++ b/src/www/js/xo.js
@@ -26,6 +26,13 @@
 	$('a:first-child').tooltip({placement:'bottom'});
 	$('a').tooltip();
 
+	$('a[data-confirm]').click(function(e) {
+		if (!window.confirm($(this).attr('data-confirm')))
+		{
+			e.preventDefault();
+		}
+	});
+
 	/**
 	 * Blink Bell
 	 *
diff --git a/src/www/users.php b/src/www/users.php
index 09b222786c..d77a2f6fe3 100644
--- a/src/www/users.php
+++ b/src/www/users.php
@@ -22,8 +22,48 @@
  * @package Xen Orchestra Web
  */
 $application = require(__DIR__.'/../bootstrap.php');
+$xo = $application->xo;
+
+$referer = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : false;
+
+if (isset($_GET['a']))
+{
+	$action = $_GET['a'];
+	try
+	{
+		if ($action === 'delete')
+		{
+			$xo->user->delete($_GET['id']);
+			$application->redirect($referer ?: './');
+			return;
+		}
+		if ($action === 'create')
+		{
+			$xo->user->create($_POST['name'], $_POST['password']);
+			$application->redirect($referer ?: './');
+			return;
+		}
+	}
+	catch (XO_Exception $e)
+	{
+		$application->getTemplate('/_generic/error.html')->render(array(
+			'error'   => ucfirst($action).' failed',
+			'message' => $e->getMessage(),
+			'referer' => $referer,
+		));
+		return;
+	}
+}
+
+
+$users = $xo->user->getAll();
+foreach ($users as &$user)
+{
+	$user = (object) $user; // Template system only handles objects.
+}
 
 $application->getTemplate('/admin/users.html')->render(array(
 	'admin' => true,
-	'users' => true,
+	'menu_admin_users' => true,
+	'users' => $users,
 ));