system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
# -*- coding: utf-8 -*-
"""
Resources below '/<api_base>/token'
"""
import os
import logging

from flask import request
from flask_restful import Resource
from flask_jwt_extended import jwt_refresh_token_required, create_access_token, create_refresh_token, get_jwt_identity
from http import HTTPStatus

from .. import server
from .. import db
from .. import util

module_name = __name__.split('.')[-1]
log = logging.getLogger(module_name)


def setup(api, API_BASE):

    path = os.path.join(API_BASE, module_name)
    log.info(f'Setting up "{path}" and subdirectories')

    api.add_resource(
        Token,
        path,
        endpoint='token',
        methods=('POST',)
    )

    api.add_resource(
        RefreshToken,
        path+'/refresh',
        endpoint='refresh_token',
        methods=('POST',)
    )


# ------------------------------------------------------------------------------
# Resources / API's
# ------------------------------------------------------------------------------
class Token(Resource):
    """resource for api/token"""

    def post(self):
        """Authenticate user or node"""
        if not request.is_json:
            log.warning('POST request without JSON body.')
            return {"msg": "Missing JSON in request"}, HTTPStatus.BAD_REQUEST

        username = request.json.get('username', None)
        password = request.json.get('password', None)

        if not (username and password):
            msg = "no user/password combination provided"
            return {"msg": msg}, HTTPStatus.UNAUTHORIZED

        log.info("trying to login '{}'".format(username))

        if db.User.username_exists(username):
            user = db.User.getByUsername(username)
            if not user.check_password(password):
                msg = f"password for '{username}' is invalid"
                log.error(msg)
                return {"msg": msg}, HTTPStatus.UNAUTHORIZED
        else:
            msg = f"username '{username}' does not exist"
            log.error(msg)
            return {"msg": msg}, HTTPStatus.UNAUTHORIZED

        log.info("Successful login for '{}'".format(username))

        ret = {
            'access_token': create_access_token(user),
            'refresh_token': create_refresh_token(user),
            'refresh_url': server.api.url_for(RefreshToken),
            'fullname': user.getFullname(),
            'roles': [r.name for r in user.roles],
        }

        return ret, HTTPStatus.OK


class RefreshToken(Resource):

    @jwt_refresh_token_required
    def post(self):
        """Create a token from a refresh token."""
        user_id = get_jwt_identity()
        log.info(f'Refreshing token for user_id {user_id}')
        user = db.User.get(user_id)
        ret = {'access_token': create_access_token(user)}

        return ret, HTTPStatus.OK

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-94: Improper Control of Generation of Code ('Code Injection')
  B) CWE-117: Improper Output Neutralization for Logs
  C) CWE-312: Cleartext Storage of Sensitive Information
  D) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
  E) CWE-215: Insertion of Sensitive Information Into Debugging Code
  F) CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Answer: B