    def test_login_inactive_user(self):
        self.user.is_active = False
        self.user.save()

        login_code = LoginCode.objects.create(user=self.user, code='foobar')

        response = self.client.post('/accounts-rest/login/code/', {
            'code': login_code.code,
        })

        self.assertEqual(response.status_code, 400)
        self.assertEqual(response.json(), {
            'code': ['Unable to log in with provided login code.'],
        })
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.