If the supertest request fails its basic assertions, there may not even
be a body to perform checks against, so bail early when possible.

Safer tests - step1 [back-port to 2.x]

We should never be showing this publically.

Adds unit test for hiding verification token.

This is a back-port of pull request #1851 from gausie/patch-4

Update PersistedModel.findOrCreate() JSDoc to reflect the
callback accepts an additional created boolean parameter.

This is a back-port of pull request #1983 from noderat/patch-1

Fix travis platforms [2.x]

Fix race condition in error handler test

* Change.diff
* Change.findOrCreateChange
* Change.rectifyModelChanges
* Change.prototype.currentRevision
* Change.prototype.rectify

Using console.log like this can result in invalid xml when the xunit
reporter is used.

[Backport of pull request #2035]

 * Remove sl-blip from dependency (Candy)
 * Fix race condition in replication tests (Miroslav Bajtoš)
 * test: remove errant console.log from test (Ryan Graham)
 * Promisify Model Change (Jue Hou)
 * Fix race condition in error handler test (Miroslav Bajtoš)
 * Travis: drop iojs, add v4.x and v5.x (Miroslav Bajtoš)
 * Correct JSDoc findOrCreate() callback in PersistedModel (Miroslav Bajtoš)
 * Hide verificationToken (Miroslav Bajtoš)
 * test: use ephemeral port for e2e server (Ryan Graham)
 * test: fail on error instead of crash (Ryan Graham)
 * ensure app is booted before integration tests (Ryan Graham)
 * Checkpoint speedup (Amir Jafarian)
 * Pull in API doc fix from PR into master #1910 (crandmck)

[back-port of pull request #2088]

[back-port of pull request #2105]

Add two new options:

  - When `enableDoublecheck` is true, the middleware will run
    even if a previous middleware has already set `req.accessToken`
    (possibly to `null` for anonymous requests)

  - When `overwriteExistingToken` is true (and `enableDoublecheck` too),
    the middleware will overwrite `req.accessToken` set by a previous
    middleware instances.

Allow built-in token middleware to run repeatedly [back-port to 2.x]

Prevent apps from crashing when using `Model.nestRemoting` without
`{ hooks: false }` option.

Note that it is not possible to reproduce this bug using our current
Mocha test suite, because other tests modify the global state in such
way that the bug no longer occurs.

[back-port of #2245]

… a remote method.

Signed-off-by: Supasate Choochaisri <supasate.c@gmail.com>

…-method-event

BACKPORT Add new feature to emit a `remoteMethodDisabled` event when disabling

 * Add new feature to emit a `remoteMethodDisabled` event when disabling a remote method. (Supasate Choochaisri)
 * Fix typo in Model.nestRemoting (Tim Needham)
 * Allow built-in token middleware to run repeatedly (Benjamin Kröger)
 * Improve error message on connector init error (Miroslav Bajtoš)
 * application: correct spelling of "cannont" (Sam Roberts)

Rework User tests to not depend on `app.autoAttach()` and global shared
registry of Models. Instead, each tests creates a fresh app instance
with a new in-memory datasource and a new set of Models.

Rework tests in `test/rest.middleware.test.js` to not depend
on `app.autoAttach()` and global shared registry of Models. Instead,
each tests creates a fresh app instance with a new in-memory datasource
and a new set of Models.

Clean up unit-tests - use local registry [2.x]

Node v6 no longer supports port:undefined, this commit is fixing
app.listen() to correctly send port:0 when no port is specified.

Support node v6 in 2.x

- Also fix jshint error in backported test

Signed-off-by: Supasate Choochaisri <supasate.c@gmail.com>

…ate-role-names

Backport/do not allow duplicate role names

…done-logic

Backport separate error checking and done logic

allow to change all {href} instances in user.verify() mail into generated url instead of just one

…-verification-email

Update user.js