DBC-Susteq/susteq — pull request #8 by opleban (2014-09-24 19:44:32+00:00)
Title: Authorizes transactions

Removes "require_admin_sign_in" filter from Transactions Controller and utilizes an authorize_transaction helper method instead that looks for log-in credentials (i.e.) email and password in the params string. It will only add new transaction if it is able to authenticate the email/password combo.

I had some concern over sending email/password combo in the post request. However, from what I understand in my research into the issue, as long as they use https it should be alright with a post request.

http://security.stackexchange.com/questions/33793/handling-passwords-in-a-web-application

@melissa-mccoy