 			afterEach ->
 				delete @req.session.postLoginRedirect
 
-			it 'should call req.login', () ->
+			it 'should call finishLogin', () ->
 				@AuthenticationController.passportLogin @req, @res, @next
-				@req.login.callCount.should.equal 1
-				@req.login.calledWith(@user).should.equal true
-
-			it 'should send a json response with redirect', () ->
-				@AuthenticationController.passportLogin @req, @res, @next
-				@res.json.callCount.should.equal 1
-				@res.json.calledWith({redir: 'some_redirect'}).should.equal true
-
-			describe 'when session.save produces an error', () ->
-				beforeEach ->
-					@req.session.save = sinon.stub().callsArgWith(0, new Error('woops'))
-
-				it 'should return next with an error', () ->
-					@AuthenticationController.passportLogin @req, @res, @next
-					@next.calledWith(@err).should.equal true
-
-				it 'should not return json', () ->
-					@AuthenticationController.passportLogin @req, @res, @next
-					@res.json.callCount.should.equal 0
+				@AuthenticationController.finishLogin.callCount.should.equal 1
+				@AuthenticationController.finishLogin.calledWith(@user).should.equal true
 
 		describe 'when authenticate does not produce a user', ->
 

				@LoginRateLimiter.processLoginRequest.callsArgWith(1, null, true)
				@AuthenticationManager.authenticate = sinon.stub().callsArgWith(2, null, @user)
				@req.sessionID = Math.random()
				@AnalyticsManager.identifyUser = sinon.stub()
				@AuthenticationController.doPassportLogin(@req, @req.body.email, @req.body.password, @cb)

			it "should attempt to authorise the user", ->

					.calledWith(email: @email.toLowerCase(), @password)
					.should.equal true

			it "should establish the user's session", ->
				@cb.calledWith(null, @user).should.equal true

			# TODO: move these to a test for the async handlers, or for finishLogin

			# it "should call identifyUser", ->
			# 	@AnalyticsManager.identifyUser.calledWith(@user._id, @req.sessionID).should.equal true

			# it "should setup the user data in the background", ->
			# 	@UserHandler.setupLoginData.calledWith(@user).should.equal true

			# it "should set res.session.justLoggedIn", ->
			# 	@req.session.justLoggedIn.should.equal true

			# it "should record the successful login", ->
			# 	@AuthenticationController._recordSuccessfulLogin
			# 		.calledWith(@user._id)
			# 		.should.equal true

			# it "should tell the rate limiter that there was a success for that email", ->
			# 	@LoginRateLimiter.recordSuccessfulLogin.calledWith(@email.toLowerCase()).should.equal true

			# it "should log the successful login", ->
			# 	@logger.log
			# 		.calledWith(email: @email.toLowerCase(), user_id: @user._id.toString(), "successful log in")
			# 		.should.equal true

			# it "should track the login event", ->
			# 	@AnalyticsManager.recordEvent
			# 		.calledWith(@user._id, "user-logged-in")
			# 		.should.equal true

		describe 'when the user is not authenticated', ->
			beforeEach ->
