    it "requires an account with mail" do
      user = FactoryGirl.create(:user)
      get :index, {}, set_session_user.merge(:user => user.id)
      assert_response :redirect
      assert_redirected_to edit_user_path(user)
      assert_equal "An email address is required, please update your account details", flash[:error]
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.