     expect(res.statusCode).toBe(200)
     expect(res.body.coursePrepaid._id).toBe(user.get('coursePrepaidID').toString())
     expect(res.body.coursePrepaid.startDate).toBe(Prepaid.DEFAULT_START_DATE)
-    
+
+  it 'looks up the user by id', utils.wrap ->
+    user = yield utils.initUser()
+    yield utils.becomeAnonymous()
+    url = utils.getURL("/db/user/#{user.id}")
+    [res] = yield request.getAsync({url, json: true})
+    expect(res.statusCode).toBe(200)
+    expect(res.body.name).toBe(user.get('name'))  # Anyone should be served the username.
+    expect(res.body.email).toBeUndefined()  # Shouldn't be available to anonymous users.
+    expect(res.body.passwordHash).toBeUndefined()
+
 
 describe 'DELETE /db/user/:handle', ->
   it 'can delete a user', utils.wrap ->

    [res] = yield request.putAsync { uri: getURL('/db/user/'+invalidUser.id), json: { name: 'A new name' }}
    expect(res.statusCode).toBe(200)
    expect(res.body.name).toBe('A new name')
    

describe 'PUT /db/user/-/become-student', ->


describe 'POST /db/user', ->

  beforeEach utils.wrap ->
    yield utils.clearModels [User]
        
  it 'converts the password into a hash', utils.wrap ->
    yield utils.becomeAnonymous()
    email = 'some-name@email.com'
    password = 'food'
    [res] = yield request.postAsync({ url: utils.getURL('/db/user'), json: {email, password}})
    expect(res.statusCode).toBe(200)
    user = yield User.findById(res.body._id)
    expect(user).toBeTruthy()
    expect(user.get('password')).toBeUndefined()
    expect(user.get('passwordHash')[..5] in ['31dc3d', '948c7e']).toBeTruthy()
    expect(user.get('permissions')).toBeUndefined()

    
describe 'PUT /db/user', ->

  it 'returns 422 when no data is provided', utils.wrap ->
