Make login links side-effect free

app/controllers/sessions_controller.rb

@@ -1,5 +1,8 @@
 class SessionsController < ApplicationController
 
+  def new
+  end
+
   def create
     user = login_service.validate(params[:token].to_s.strip)
 

app/views/sessions/new.html.erb

@@ -0,0 +1,13 @@
+<div class="container">
+  <div class="row">
+    <div class="col-md-12">
+      <h1>Welcome.</h1>
+      <br>
+      <p>Click the button and you're in!</p>
+      <br>
+      <form method="POST">
+        <input type="submit" value="Log in" class="btn btn-primary">
+      </form>
+    </div>
+  </div>
+</div>

config/routes.rb

@@ -30,7 +30,8 @@ Rails.application.routes.draw do
 
   get "/login" => redirect("/login/new")
 
-  get "/login/:token" => "sessions#create", as: :login_token
+  get "/login/:token" => "sessions#new", as: :login_token
+  post "/login/:token" => "sessions#create"
   get "/logout" => "sessions#destroy"
 
   resources :api_tokens, only: [:create, :destroy]

spec/controllers/sessions_controller_spec.rb

@@ -2,8 +2,20 @@ require 'rails_helper'
 
 describe SessionsController do
 
+  describe "#new" do
+    subject { get :new, token: 'the-to-ken' }
+
+    before do
+      subject
+    end
+
+    it "displays button" do
+      should render_template('new')
+    end
+  end
+
   describe "#create" do
-    subject { get :create, token: 'the-to-ken' }
+    subject { post :create, token: 'the-to-ken' }
 
     let(:login_service) { double(:login_service) }
 

spec/support/authentication.rb

@@ -24,6 +24,7 @@ module Asciinema
         fill_in :email, with: user.email
         click_button 'Log in'
         visit "/login/#{user.expiring_tokens.last.token}"
+        click_button "Log in"
       end
     end
   end