@ -778,6 +778,7 @@ class TestAuthenticationViewSet(viewsets.ViewSet):
if not settings.DEBUG:
return HttpResponseBadRequest("Only allowed in debug mode.")
with transaction.atomic():
user = get_object_or_404(User.objects.all(), username=request.data.get('user').get('username'))
# Only allow test users for extra safety