Bugzilla

I found several more bugs whilst looking into this:
* the tests currently use the wrong value for `exp` (they use a value like `500` when it should be a unix timestamp)
* the Django session length is only set when fetching an existing user, and not in the case of creating a new user
* the presence of the id token header isn't validated
* test coverage is low

I've almost finished a branch that addresses these. Hopefully with that complete, we should be able to start trying out Python 3 on prototype with the aim of landing it soon.

I found several more bugs whilst looking into this:
* the tests currently use the wrong value for id token's `exp` (they use a value like `500` when it should be a unix timestamp)
* the Django session length is only set when fetching an existing user, and not in the case of creating a new user
* the presence of the id token header isn't validated
* test coverage is low

I've almost finished a branch that addresses these. Hopefully with that complete, we should be able to start trying out Python 3 on prototype with the aim of landing it soon.

I found several more bugs whilst looking into this:
* the tests currently use the wrong value for id token's `exp` (they use a value like `500` when it should be a unix timestamp)
* the Django session length is only set when fetching an existing user, and not in the case of creating a new user
* the presence of the id token header isn't validated
* several permuatations of invalid id token result in HTTP 500 rather than a 403
* already expired expiration times can result in a negative Django session length rather than a useful error
* test coverage is low

I've almost finished a branch that addresses these. Hopefully with that complete, we should be able to start trying out Python 3 on prototype with the aim of landing it soon.