.then(function(user:IUser) {
   if (user == null) {
     log.trace('Forbidden: ' + credential.username);
     deferred.reject(new StatusedError(RestStatusCodes.Forbidden));
   } else {
     log.trace('User found with credential');
     loggedInUser = user;
     return createToken(appContext, user.username, user.roles);
   }
 })

 it('should login', function () {
   return createToken('security')
     .then(function (token) {
       return loginService.login(token, 'security', {username: '[email protected]', password: 'Ohanzee1!'})
         .then(function (session:Session) {
           should.exist(session);
           (session.user.username).should.be.equal('[email protected]');
           return true;
         });
     });
 });

 unauthenticatedToken(req:Request, res:Response) {
   let appContext:string = req.params.context;
   // Don't allow no contexts even though we could support it.  Caller should know the context.
   if (appContext && ALPHANUMERIC_REGEX.test(appContext)) {
     log.trace('unauthenticatedToken for context ' + appContext);
     createToken(appContext)
       .then(function (token) {
         log.trace('unauthenticatedToken for context ' + appContext + ' results in token ' + token);
         res.status(RestStatusCodes.Success).send({token: token});
       }, function (err) {
         log.error(err);
         res.status(RestStatusCodes.ServerError).send('Server Error');
       });
   } else {
     log.trace('unauthenticatedToken doesn"t have a context');
     res.status(RestStatusCodes.BadData).send('No context');
   }
 }