    def test_login_get(self):
        login_code = LoginCode.objects.create(user=self.user)

        response = self.client.get('/accounts/login/code/', {
            'user': login_code.user.pk,
            'code': login_code.code,
        })

        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.context['form'].cleaned_data['code'], login_code.code)
        self.assertTrue(response.wsgi_request.user.is_anonymous)
        self.assertTrue(LoginCode.objects.filter(pk=login_code.pk).exists())
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.