When retrieving the a user-account the password hash is removed. At certain
moments the user is persisted again, but without the hash! So the user will
never be able to login again (except via a password reset).
The password hash should never be removed internally.
Original issue reported on code.google.com by dirkvran...@gmail.com on 3 Jan 2013 at 11:55
Original issue reported on code.google.com by
dirkvran...@gmail.com
on 3 Jan 2013 at 11:55