7 files changed, 26 insertions, 22 deletions
diff --git a/users/app/controllers/v1/sessions_controller.rb b/users/app/controllers/v1/sessions_controller.rb
index e3459d6..c99d1f3 100644
--- a/users/app/controllers/v1/sessions_controller.rb
+++ b/users/app/controllers/v1/sessions_controller.rb
@@ -29,7 +29,7 @@ module V1
 
     def destroy
       logout
-      redirect_to root_path
+      head :no_content
     end
 
     protected
diff --git a/users/app/models/login_format_validation.rb b/users/app/models/login_format_validation.rb
new file mode 100644
index 0000000..1d02bd1
--- /dev/null
+++ b/users/app/models/login_format_validation.rb
@@ -0,0 +1,19 @@
+module LoginFormatValidation
+  extend ActiveSupport::Concern
+
+  included do
+    # Have multiple regular expression validations so we can get specific error messages:
+    validates :login,
+      :format => { :with => /\A.{2,}\z/,
+        :message => "Login must have at least two characters"}
+    validates :login,
+      :format => { :with => /\A[a-z\d_\.-]+\z/,
+        :message => "Only lowercase letters, digits, . - and _ allowed."}
+    validates :login,
+      :format => { :with => /\A[a-z].*\z/,
+        :message => "Login must begin with a lowercase letter"}
+    validates :login,
+      :format => { :with => /\A.*[a-z\d]\z/,
+        :message => "Login must end with a letter or digit"}
+  end
+end
diff --git a/users/app/models/session.rb b/users/app/models/session.rb
index a9fdb1b..0d7e10e 100644
--- a/users/app/models/session.rb
+++ b/users/app/models/session.rb
@@ -1,12 +1,10 @@
 class Session < SRP::Session
   include ActiveModel::Validations
+  include LoginFormatValidation
 
   attr_accessor :login
 
-  validates :login,
-    :presence => true,
-    :format => { :with => /\A[A-Za-z\d_]+\z/,
-      :message => "Only letters, digits and _ allowed" }
+  validates :login, :presence => true
 
   def initialize(user = nil, aa = nil)
     super(user, aa) if user
diff --git a/users/app/models/user.rb b/users/app/models/user.rb
index 0a89f7c..c1988f3 100644
--- a/users/app/models/user.rb
+++ b/users/app/models/user.rb
@@ -1,4 +1,5 @@
 class User < CouchRest::Model::Base
+  include LoginFormatValidation
 
   use_database :users
 
@@ -15,20 +16,6 @@ class User < CouchRest::Model::Base
     :uniqueness => true,
     :if => :serverside?
 
-  # Have multiple regular expression validations so we can get specific error messages:
-  validates :login,
-    :format => { :with => /\A.{2,}\z/,
-      :message => "Login must have at least two characters"}
-  validates :login,
-    :format => { :with => /\A[a-z\d_\.-]+\z/,
-      :message => "Only lowercase letters, digits, . - and _ allowed."}
-  validates :login,
-    :format => { :with => /\A[a-z].*\z/,
-      :message => "Login must begin with a lowercase letter"}
-  validates :login,
-    :format => { :with => /\A.*[a-z\d]\z/,
-      :message => "Login must end with a letter or digit"}
-
   validate :login_is_unique_alias
 
   validates :password_salt, :password_verifier,
diff --git a/users/app/views/users/_warnings.html.haml b/users/app/views/users/_warnings.html.haml
index 7e0b2ce..79ab103 100644
--- a/users/app/views/users/_warnings.html.haml
+++ b/users/app/views/users/_warnings.html.haml
@@ -1,5 +1,5 @@
 %noscript
-  %div.alert.alert-error=t :js_required
+  %div.alert.alert-error=t :js_required_html
 #cookie_warning.alert.alert-error{:style => "display:none"}
   =t :cookie_disabled_warning
 :javascript
diff --git a/users/config/locales/en.yml b/users/config/locales/en.yml
index 62f822c..55ba3a1 100644
--- a/users/config/locales/en.yml
+++ b/users/config/locales/en.yml
@@ -32,7 +32,7 @@ en:
   not_authorized_login: "Please log in to perform that action."
   search: "Search"
   cookie_disabled_warning: "You have cookies disabled. You will not be able to login until you enable cookies."
-  js_required: "We are sorry, but this doesn't work without javascript enabled. This is for security reasons."
+  js_required_html: "We are sorry, but this doesn't work without javascript enabled. This is because the authentication system used, <a href='http://srp.stanford.edu/'>SRP</a>, requires javascript."
   enable_account: "Enable the account %{username}"
   enable_description: "This will restore the account to full functionality"
   deactivate_account: "Deactivate the account %{username}"
diff --git a/users/test/integration/browser/account_test.rb b/users/test/integration/browser/account_test.rb
index c65c491..b412980 100644
--- a/users/test/integration/browser/account_test.rb
+++ b/users/test/integration/browser/account_test.rb
@@ -28,8 +28,8 @@ class AccountTest < BrowserIntegrationTest
     fill_in 'Password', with: "password"
     inject_malicious_js
     click_on 'Log In'
-    assert !page.has_content?("Welcome")
     assert page.has_content?("Invalid random key")
+    assert page.has_no_content?("Welcome")
   end
 
   def inject_malicious_js