It's happening! Seems to work.

I do think we need some mechanism to throttle the speed of attempts
to prevent brute force. This would be a separate PR.

	modified:   models/user.py
	modified:   templates/join-or-log-in.j2
	modified:   templates/verification-challenge.j2
	modified:   views/authentication.py

make_post_sell/models/user.py

@@ -128,8 +128,7 @@ class User(RBase, Base):
             stored_hash.encode("utf-8"),
         ).decode("utf-8")
 
-        log.info("new_hash={} stored_hash={}".format(new_hash, stored_hash))
-        print("blah")
+        #log.info("new_hash={} stored_hash={}".format(new_hash, stored_hash))
 
         if new_hash == stored_hash:
             return True

make_post_sell/templates/join-or-log-in.j2

@@ -30,7 +30,7 @@
     <br/>
     <br/>
 
-    <input type="submit" name="submit" value="send log in email" />
+    <input type="submit" name="submit" id="submit" value="send verification code to email" />
   
     {% if return_to %}
     <input type="hidden" name="return-to" value="{{ return_to }}" >

make_post_sell/templates/verification-challenge.j2

@@ -3,11 +3,10 @@
 <section class="one-column">
   <section class="log-in-form well">
   <h2>Verification Code</h2>
-   <b>Please enter code to verify & log in.<b>
+   <b>Please enter code to log in.<b>
    <br>
    <br>
-   <form method="post" action="/verification-challenge" onsubmit="submit.disabled = true; return true;">
-
+   <form method="post" action="/verification-challenge">
       <input
           name        = "email"
           type        = "hidden"
@@ -22,7 +21,7 @@
           id          = "raw-otp"
           class       = "common-text-input"
           tabindex    = "1"
-          value       = ""
+          value       = "{% if raw_otp  %}{{ raw_otp }}{% endif %}"
           placeholder = "6 digit challenge verification code"
           required
           autofocus />
@@ -30,11 +29,12 @@
     <br/>
     <br/>
 
-    <input type="submit" name="submit" value="verify code" />
-  
     {% if return_to %}
     <input type="hidden" name="return-to" value="{{ return_to }}" >
     {% endif %}
+
+    <input type="submit" name="submit" id="submit" value="verify code" required />
+  
    </form>
     <br/>
   </section>

make_post_sell/views/authentication.py

@@ -107,38 +107,38 @@ def verification_challenge(request):
         # get or create a User object from the posted email.
         user = get_or_create_user_by_email(request.dbsession, email)
 
-    print("blah33")
-    print(raw_otp)
+    print(request.params)
 
-    if raw_otp and user.check_password(raw_otp):
-        # success: the user was verified.
-        user.verified = True
-        name = ""
-        if user.full_name:
-            name = user.name
-        msg = ("Welcome {}".format(name), "success")
-        request.session["authenticated_user_id"] = str(user.id)
-        request.session.flash(msg)
+    if "submit" in request.params:
+        if raw_otp and user.check_password(raw_otp):
+            # success: the user was verified.
+            user.verified = True
+            name = ""
+            if user.full_name:
+                name = user.name
+            msg = ("Welcome {}".format(name), "success")
+            request.session["authenticated_user_id"] = str(user.id)
+            request.session.flash(msg)
 
-        # merge any products in the session cart
-        # into user's main active cart.
-        user.active_cart.merge_in_cart(request.active_cart)
+            # merge any products in the session cart
+            # into user's main active cart.
+            user.active_cart.merge_in_cart(request.active_cart)
 
-        # make session cart match user's active cart.
-        request.session["active_cart_id"] = str(user.active_cart.id)
+            # make session cart match user's active cart.
+            request.session["active_cart_id"] = str(user.active_cart.id)
 
-        # delete old session only cart.
-        request.dbsession.delete(request.active_cart)
+            # delete old session only cart.
+            request.dbsession.delete(request.active_cart)
 
-        # save user and user's active cart.
-        request.dbsession.add(user)
-        request.dbsession.add(user.active_cart)
-        request.dbsession.flush()
-        return HTTPFound(return_to)
+            # save user and user's active cart.
+            request.dbsession.add(user)
+            request.dbsession.add(user.active_cart)
+            request.dbsession.flush()
+            return HTTPFound(return_to)
 
-    else:
-        msg = ("Invalid Verification Code", "error")
-        request.session.flash(msg)
+        else:
+            msg = ("Invalid Verification Code", "error")
+            request.session.flash(msg)
 
     return {
         "title": "Please Enter Verification Code",