diff --git a/make_post_sell/tests/test_functional.py b/make_post_sell/tests/test_functional.py
index 64f478c..26e4b65 100644
--- a/make_post_sell/tests/test_functional.py
+++ b/make_post_sell/tests/test_functional.py
@@ -81,21 +81,12 @@ class UnauthenticatedFunctionalTests(FunctionalTests):
         res = redirect_res.follow()
         self.assertIn(b"You must log in to access that area.", res.body)
 
-    """
     @patch("smtplib.SMTP")
     def test_user_log_in(self, mock_smtp):
-        redirect_res1 = self.testapp.post(
-            "/join-or-log-in", {"email": "test@example.com"}, status=302
-        )
-
-        self.assertIn(b"The resource was found at", redirect_res1.body)
-
-        res = redirect_res1.follow()
-
+        redirect_res1 = self.testapp.post("/join-or-log-in", {"email": "test@example.com"})
         self.assertIn(
-            b"We just sent a link to test@example.com. Check email to log in.", res.body
-        )
-    """
+            b"We just sent a link to test@example.com. Check email to log in.",
+            redirect_res1.follow().body)
 
 
 class AuthenticatedFunctionalTests(FunctionalTests):
@@ -220,6 +211,22 @@ class AuthenticatedFunctionalTests(FunctionalTests):
         # self.csrf = res_csrf.form.fields["csrf_token"][0].value
         return res_login
 
+    def test_prevent_verification_code_brute_force(self):
+        """do not accept valid verification challenge code after failures."""
+
+        # store invlaid pass code.
+        valid_creds = self.user1_creds
+        invalid_creds = (self.user1_creds[0], "invalid")
+
+        for i in range(0,12):
+            self.log_in_user(invalid_creds)
+
+        self.log_in_user(valid_creds)
+
+        self.dbsession.refresh(self.user1)
+
+        self.assertEqual(self.user1.password_attempts, 13)
+        self.assertEqual(self.user1.authenticated, False)
 
     def test_a_girl_has_no_name(self):
         """A new user configures a display name."""