3 files changed, 14 insertions, 3 deletions
diff --git a/app/controllers/api/users_controller.rb b/app/controllers/api/users_controller.rb
index 709e076..cb7b7bc 100644
--- a/app/controllers/api/users_controller.rb
+++ b/app/controllers/api/users_controller.rb
@@ -53,7 +53,7 @@ module Api
     end
 
     def update
-      @user.account.update params[:user]
+      @user.account.update user_update_params
       respond_with @user
     end
 
@@ -67,6 +67,15 @@ module Api
 
     private
 
+    def user_update_params
+      params.require(:user).permit :login,
+        :password_verifier,
+        :password_salt,
+        :recovery_code_verifier,
+        :recovery_code_salt,
+        :public_key
+    end
+
     def release_handles
       current_user.is_monitor? || params[:identities] == "destroy"
     end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 1f37fea..d3cfc2b 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -99,7 +99,7 @@ class ApplicationController < ActionController::Base
   #
   # URL paths for which we don't enforce the locale as the prefix of the path.
   #
-  NON_LOCALE_PATHS = /^\/(assets|webfinger|.well-known|rails|key|[0-9]+)($|\/)/
+  NON_LOCALE_PATHS = /^\/(assets|webfinger|.well-known|rails|key|[0-9]+|new)($|\/)/
 
   #
   # For some requests, we ignore locale determination.
diff --git a/app/controllers/invite_codes_controller.rb b/app/controllers/invite_codes_controller.rb
index 6a7fef3..96836ee 100644
--- a/app/controllers/invite_codes_controller.rb
+++ b/app/controllers/invite_codes_controller.rb
@@ -7,7 +7,9 @@ class InviteCodesController < ApplicationController
 
   def index
     @invite  = InviteCode.new # for the creation form.
-    @invites = InviteCode.all.page(params[:page]).per(APP_CONFIG[:pagination_size])
+    @invites = InviteCode.by_updated_at.descending.
+      page(params[:page]).
+      per(APP_CONFIG[:pagination_size])
     respond_with @invites
   end