jsmestad/pivotal-tracker — pull request #44 by tomazy (2012-02-01 03:54:25+00:00)
Title: API Token security fix

After an API token has been set, any attempt to user Client.token(username, password) would return the already stored token, even if the username was for a different user. This means an API token could easily be leaked to a different session. This pull request fixes that bug by always requesting a new token with Client.token(username, password).

Also, we've fixed the specs: no failing specs, 4 pending.