    def test_login_get_non_idempotent(self):
        login_code = LoginCode.objects.create(user=self.user, next='/private/')

        response = self.client.get('/accounts/login/code/', {
            'user': login_code.user.pk,
            'code': login_code.code,
        })

        self.assertEqual(response.status_code, 302)
        self.assertEqual(response['Location'], '/private/')
        self.assertEqual(response.wsgi_request.user, self.user)
        self.assertFalse(LoginCode.objects.filter(pk=login_code.pk).exists())
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.