Hide verificationToken

[gausie]

We should never be showing this publically.

[gausie]

I don't really understand how the automated tests work - none of them have actually failed.

[bajtos]

Hi @gausie, could you please rebase your patch on top of the current master and add a unit-test covering your change? See 5b50a99 for inspiration.

As for the automated tests, our Jenkins CI server is not very stable these days. Make sure all tests pass on your machine and on Travis CI.

[bajtos]

@ritch @raymondfeng you are more familiar with user verification process than I am. Do you see any reason why it may be a bad idea to hide "verificationToken" from User JSON?

[gausie]

Rebased and unit test added.

[bajtos]

@gausie could you please squash the commits into a single one?

Note that !userJson.verificationToken is true when the token has a falsy value. You should use !('verificationToken' in userJson) instead.

I am wondering if we need to go through the whole verify process in the unit-test, isn't it enough to set the property and then check it's not serialized to JSON?

var user = new User({email: 'bar@bat.com', password: 'bar', verificationToken: 'a-token' });
var data = user.toJSON();
assert(!('verificationToken' in data));

[gausie]

@bajtos, have followed both of your recommendations

[bajtos]

@slnode test please

[bajtos]

Landed, thank you @gausie for your contribution!