    def test_login_unknown_code(self):
        response = self.client.post('/accounts-rest/login/code/', {
            'code': 'unknown',
        })

        self.assertEqual(response.status_code, 400)
        self.assertEqual(response.json(), {
            'code': ['Login code is invalid. It might have expired.'],
        })
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.