    def clean_code(self):
        code = self.cleaned_data['code']
        username = code.user.get_username()
        user = authenticate(self.request, **{
            get_user_model().USERNAME_FIELD: username,
            'code': code.code,
        })

        if not user:
            raise forms.ValidationError(
                self.error_messages['invalid_code'],
                code='invalid_code',
            )

        self.cleaned_data['user'] = user

        return code
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.