    def test_request_login_code(self):
        response = self.client.post('/accounts-rest/login/', {
            'username': self.user.username,
            'next': '/private/',
        })

        self.assertEqual(response.status_code, 200)

        login_code = LoginCode.objects.filter(user=self.user).first()

        self.assertIsNotNone(login_code)
        self.assertEqual(login_code.next, '/private/')
        self.assertEqual(len(mail.outbox), 1)
        self.assertIn(
            'http://testserver/accounts/login/code/?code={}'.format(login_code.code),
            mail.outbox[0].body,
        )
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.