steveklabnik/blog — pull request #15 by benolee (2012-06-08 03:35:25+00:00)
Title: authenticate with equality, not assignment

I should probably write a test for this, but here you go -- I'm pretty sure that assignment here just creates a new record in the db. In other words, if I know your email address (which is in the dev sqlite db, btw) then I can authenticate as you on your website, since it's just assigning a new encrypted password.