=== added file 'lava_scheduler_app/migrations/0012_auto__add_field_testjob_submit_token.py'
--- lava_scheduler_app/migrations/0012_auto__add_field_testjob_submit_token.py	1970-01-01 00:00:00 +0000
+++ lava_scheduler_app/migrations/0012_auto__add_field_testjob_submit_token.py	2012-01-20 01:15:16 +0000
@@ -0,0 +1,105 @@
+# encoding: utf-8
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+class Migration(SchemaMigration):
+
+    def forwards(self, orm):
+        
+        # Adding field 'TestJob.submit_token'
+        db.add_column('lava_scheduler_app_testjob', 'submit_token', self.gf('django.db.models.fields.related.ForeignKey')(to=orm['linaro_django_xmlrpc.AuthToken'], null=True), keep_default=False)
+
+
+    def backwards(self, orm):
+        
+        # Deleting field 'TestJob.submit_token'
+        db.delete_column('lava_scheduler_app_testjob', 'submit_token_id')
+
+
+    models = {
+        'auth.group': {
+            'Meta': {'object_name': 'Group'},
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+            'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'auth.permission': {
+            'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+            'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+        },
+        'auth.user': {
+            'Meta': {'object_name': 'User'},
+            'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+            'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+            'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+            'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+            'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+            'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+            'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+            'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+        },
+        'contenttypes.contenttype': {
+            'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+            'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+            'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+        },
+        'lava_scheduler_app.device': {
+            'Meta': {'object_name': 'Device'},
+            'current_job': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['lava_scheduler_app.TestJob']", 'unique': 'True', 'null': 'True', 'blank': 'True'}),
+            'device_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['lava_scheduler_app.DeviceType']"}),
+            'hostname': ('django.db.models.fields.CharField', [], {'max_length': '200', 'primary_key': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {'default': '1'}),
+            'tags': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['lava_scheduler_app.Tag']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'lava_scheduler_app.devicetype': {
+            'Meta': {'object_name': 'DeviceType'},
+            'name': ('django.db.models.fields.SlugField', [], {'max_length': '50', 'primary_key': 'True', 'db_index': 'True'})
+        },
+        'lava_scheduler_app.tag': {
+            'Meta': {'object_name': 'Tag'},
+            'description': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'name': ('django.db.models.fields.SlugField', [], {'unique': 'True', 'max_length': '50', 'db_index': 'True'})
+        },
+        'lava_scheduler_app.testjob': {
+            'Meta': {'object_name': 'TestJob'},
+            'actual_device': ('django.db.models.fields.related.ForeignKey', [], {'default': 'None', 'related_name': "'+'", 'null': 'True', 'blank': 'True', 'to': "orm['lava_scheduler_app.Device']"}),
+            'definition': ('django.db.models.fields.TextField', [], {}),
+            'description': ('django.db.models.fields.CharField', [], {'default': 'None', 'max_length': '200', 'null': 'True', 'blank': 'True'}),
+            'end_time': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'log_file': ('django.db.models.fields.files.FileField', [], {'default': 'None', 'max_length': '100', 'null': 'True', 'blank': 'True'}),
+            'requested_device': ('django.db.models.fields.related.ForeignKey', [], {'default': 'None', 'related_name': "'+'", 'null': 'True', 'blank': 'True', 'to': "orm['lava_scheduler_app.Device']"}),
+            'requested_device_type': ('django.db.models.fields.related.ForeignKey', [], {'default': 'None', 'related_name': "'+'", 'null': 'True', 'blank': 'True', 'to': "orm['lava_scheduler_app.DeviceType']"}),
+            'results_link': ('django.db.models.fields.CharField', [], {'default': 'None', 'max_length': '400', 'null': 'True', 'blank': 'True'}),
+            'start_time': ('django.db.models.fields.DateTimeField', [], {'null': 'True', 'blank': 'True'}),
+            'status': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+            'submit_time': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'blank': 'True'}),
+            'submit_token': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['linaro_django_xmlrpc.AuthToken']", 'null': 'True'}),
+            'submitter': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"}),
+            'tags': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['lava_scheduler_app.Tag']", 'symmetrical': 'False', 'blank': 'True'})
+        },
+        'linaro_django_xmlrpc.authtoken': {
+            'Meta': {'object_name': 'AuthToken'},
+            'created_on': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+            'description': ('django.db.models.fields.TextField', [], {'default': "''", 'blank': 'True'}),
+            'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+            'last_used_on': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+            'secret': ('django.db.models.fields.CharField', [], {'default': "'z53d9om32nyy04rnuhy09xi5emz00f02igc497gjpz8lkjd02uijemou95fyyjfgrsttfzbg4hm0y10u5jbpcxyfowq669b6q6ud6z6rjkbzgatobh066exd45rx88q7'", 'unique': 'True', 'max_length': '128'}),
+            'user': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'auth_tokens'", 'to': "orm['auth.User']"})
+        }
+    }
+
+    complete_apps = ['lava_scheduler_app']

=== modified file 'lava_scheduler_app/models.py'
--- lava_scheduler_app/models.py	2012-01-20 00:23:26 +0000
+++ lava_scheduler_app/models.py	2012-01-20 01:15:16 +0000
@@ -4,6 +4,7 @@
 from django.db import models
 from django.utils.translation import ugettext as _
 
+from linaro_django_xmlrpc.models import AuthToken
 
 class JSONDataError(ValueError):
     """Error raised when JSON is syntactically valid but ill-formed."""
@@ -135,6 +136,8 @@
         verbose_name = _(u"Submitter"),
     )
 
+    submit_token = models.ForeignKey(AuthToken, null=True)
+
     description = models.CharField(
         verbose_name = _(u"Description"),
         max_length = 200,

=== modified file 'lava_scheduler_app/tests.py'
--- lava_scheduler_app/tests.py	2012-01-20 00:23:26 +0000
+++ lava_scheduler_app/tests.py	2012-01-24 01:43:43 +0000
@@ -3,14 +3,16 @@
 import json
 import xmlrpclib
 
-from django.db import transaction
 from django.contrib.auth.models import Permission, User
+from django.test import TransactionTestCase
 from django.test.client import Client
 
 from django_testscenarios.ubertest import TestCase
 
+from linaro_django_xmlrpc.models import AuthToken
+
 from lava_scheduler_app.models import Device, DeviceType, Tag, TestJob
-
+from lava_scheduler_daemon.dbjobsource import DatabaseJobSource
 
 
 # Based on http://www.technobabble.dk/2008/apr/02/xml-rpc-dispatching-through-django-test-client/
@@ -26,9 +28,6 @@
         self._use_datetime = True
 
     def request(self, host, handler, request_body, verbose=0):
-        from django.conf import settings
-        # This is a total hack.  See bug 904054 for more.
-        settings.MOUNT_POINT = ''
         self.verbose = verbose
         response = self.client.post(
             handler, request_body, content_type="text/xml")
@@ -240,10 +239,6 @@
         self.assertEqual(TestJob.CANCELED, job.status)
 
 
-from django.test import TransactionTestCase
-
-from lava_scheduler_daemon.dbjobsource import DatabaseJobSource
-
 class TransactionTestCaseWithFactory(TransactionTestCase):
 
     def setUp(self):
@@ -251,26 +246,32 @@
         self.factory = ModelFactory()
 
 
+class NonthreadedDatabaseJobSource(DatabaseJobSource):
+    deferToThread = staticmethod(lambda f, *args, **kw: f(*args, **kw))
+
+
 class TestDBJobSource(TransactionTestCaseWithFactory):
 
+    def setUp(self):
+        super(TestDBJobSource, self).setUp()
+        self.source = NonthreadedDatabaseJobSource()
+
     def test_getBoardList(self):
         self.factory.make_device(hostname='panda01')
-        self.assertEqual(['panda01'], DatabaseJobSource().getBoardList_impl())
+        self.assertEqual(['panda01'], self.source.getBoardList())
 
     def test_getJobForBoard_returns_json(self):
         device = self.factory.make_device(hostname='panda01')
         definition = {'foo': 'bar', 'target': 'panda01'}
         self.factory.make_testjob(
             requested_device=device, definition=json.dumps(definition))
-        transaction.commit()
         self.assertEqual(
-            definition, DatabaseJobSource().getJobForBoard_impl('panda01'))
+            definition, self.source.getJobForBoard('panda01'))
 
     def test_getJobForBoard_returns_None_if_no_job(self):
         self.factory.make_device(hostname='panda01')
-        transaction.commit()
         self.assertEqual(
-            None, DatabaseJobSource().getJobForBoard_impl('panda01'))
+            None, self.source.getJobForBoard('panda01'))
 
     def test_getJobForBoard_considers_device_type(self):
         panda_type = self.factory.ensure_device_type(name='panda')
@@ -279,10 +280,9 @@
         self.factory.make_testjob(
             requested_device_type=panda_type,
             definition=json.dumps(definition))
-        transaction.commit()
         definition['target'] = 'panda01'
         self.assertEqual(
-            definition, DatabaseJobSource().getJobForBoard_impl('panda01'))
+            definition, self.source.getJobForBoard('panda01'))
 
     def test_getJobForBoard_prefers_older(self):
         panda_type = self.factory.ensure_device_type(name='panda')
@@ -296,10 +296,9 @@
         self.factory.make_testjob(
             requested_device=panda01, definition=json.dumps(second_definition),
             submit_time=datetime.datetime.now())
-        transaction.commit()
         self.assertEqual(
             first_definition,
-            DatabaseJobSource().getJobForBoard_impl('panda01'))
+            self.source.getJobForBoard('panda01'))
 
     def test_getJobForBoard_prefers_directly_targeted(self):
         panda_type = self.factory.ensure_device_type(name='panda')
@@ -314,10 +313,9 @@
         self.factory.make_testjob(
             requested_device=panda01,
             definition=json.dumps(device_definition))
-        transaction.commit()
         self.assertEqual(
             device_definition,
-            DatabaseJobSource().getJobForBoard_impl('panda01'))
+            self.source.getJobForBoard('panda01'))
 
     def test_getJobForBoard_avoids_targeted_to_other_board_of_same_type(self):
         panda_type = self.factory.ensure_device_type(name='panda')
@@ -328,10 +326,9 @@
         self.factory.make_testjob(
             requested_device=panda01,
             definition=json.dumps(definition))
-        transaction.commit()
         self.assertEqual(
             None,
-            DatabaseJobSource().getJobForBoard_impl('panda02'))
+            self.source.getJobForBoard('panda02'))
 
     def _makeBoardWithTags(self, tags):
         board = self.factory.make_device()
@@ -350,14 +347,14 @@
         self._makeJobWithTagsForBoard(job_tags, board)
         self.assertEqual(
             board.hostname,
-            DatabaseJobSource().getJobForBoard_impl(board.hostname)['target'])
+            self.source.getJobForBoard(board.hostname)['target'])
 
     def assertBoardWithTagsDoesNotGetJobWithTags(self, board_tags, job_tags):
         board = self._makeBoardWithTags(board_tags)
         self._makeJobWithTagsForBoard(job_tags, board)
         self.assertEqual(
             None,
-            DatabaseJobSource().getJobForBoard_impl(board.hostname))
+            self.source.getJobForBoard(board.hostname))
 
     def test_getJobForBoard_does_not_return_job_if_board_lacks_tag(self):
         self.assertBoardWithTagsDoesNotGetJobWithTags([], ['tag'])
@@ -384,8 +381,7 @@
         device = self.factory.make_device(hostname='panda01')
         job = self.factory.make_testjob(requested_device=device)
         before = datetime.datetime.now()
-        transaction.commit()
-        DatabaseJobSource().getJobForBoard_impl('panda01')
+        self.source.getJobForBoard('panda01')
         after = datetime.datetime.now()
         # reload from the database
         job = TestJob.objects.get(pk=job.pk)
@@ -394,8 +390,7 @@
     def test_getJobForBoard_set_statuses(self):
         device = self.factory.make_device(hostname='panda01')
         job = self.factory.make_testjob(requested_device=device)
-        transaction.commit()
-        DatabaseJobSource().getJobForBoard_impl('panda01')
+        self.source.getJobForBoard('panda01')
         # reload from the database
         job = TestJob.objects.get(pk=job.pk)
         device = Device.objects.get(pk=device.pk)
@@ -406,24 +401,91 @@
     def test_getJobForBoard_sets_running_job(self):
         device = self.factory.make_device(hostname='panda01')
         job = self.factory.make_testjob(requested_device=device)
-        transaction.commit()
-        DatabaseJobSource().getJobForBoard_impl('panda01')
+        self.source.getJobForBoard('panda01')
         # reload from the database
         job = TestJob.objects.get(pk=job.pk)
         device = Device.objects.get(pk=device.pk)
         self.assertEqual(job, device.current_job)
 
+    def test_getJobForBoard_creates_token(self):
+        device = self.factory.make_device(hostname='panda01')
+        job = self.factory.make_testjob(requested_device=device)
+        self.source.getJobForBoard('panda01')
+        # reload from the database
+        job = TestJob.objects.get(pk=job.pk)
+        device = Device.objects.get(pk=device.pk)
+        self.assertIsNotNone(job.submit_token)
+        self.assertEqual(job.submitter, job.submit_token.user)
+
+    def test_getJobForBoard_inserts_target_into_json(self):
+        panda_type = self.factory.ensure_device_type(name='panda')
+        self.factory.make_device(hostname='panda01', device_type=panda_type)
+        definition = {'foo': 'bar'}
+        self.factory.make_testjob(
+            requested_device_type=panda_type,
+            definition=json.dumps(definition))
+        json_data = self.source.getJobForBoard('panda01')
+        self.assertIn('target', json_data)
+        self.assertEqual('panda01', json_data['target'])
+
+    def test_getJobForBoard_inserts_submit_token_into_json(self):
+        panda_type = self.factory.ensure_device_type(name='panda')
+        self.factory.make_device(hostname='panda01', device_type=panda_type)
+        definition = {
+            'actions': [
+                {
+                    "command": "submit_results",
+                    "parameters":
+                    {
+                        "server": "http://test-server/RPC2/",
+                        "stream": "/private/personal/test/test/",
+                    }
+                }
+            ]
+        }
+        job = self.factory.make_testjob(
+            requested_device_type=panda_type,
+            definition=json.dumps(definition))
+        json_data = self.source.getJobForBoard('panda01')
+        job = TestJob.objects.get(pk=job.pk)
+        submit_job_params = json_data['actions'][0]['parameters']
+        self.assertIn('token', submit_job_params)
+        self.assertEqual(job.submit_token.secret, submit_job_params['token'])
+
+    def test_getJobForBoard_adds_user_to_url(self):
+        panda_type = self.factory.ensure_device_type(name='panda')
+        self.factory.make_device(hostname='panda01', device_type=panda_type)
+        user = User.objects.create_user('test', 'e@mail.invalid', 'test')
+        user.save()
+        definition = {
+            'actions': [
+                {
+                    "command": "submit_results",
+                    "parameters":
+                    {
+                        "server": "http://test-server/RPC2/",
+                        "stream": "/private/personal/test/test/",
+                    }
+                }
+            ]
+        }
+        job = self.factory.make_testjob(
+            requested_device_type=panda_type, submitter=user,
+            definition=json.dumps(definition))
+        json_data = self.source.getJobForBoard('panda01')
+        job = TestJob.objects.get(pk=job.pk)
+        submit_job_params = json_data['actions'][0]['parameters']
+        self.assertEqual("http://test@test-server/RPC2/", submit_job_params['server'])
+
     def get_device_and_running_job(self):
         device = self.factory.make_device(hostname='panda01')
         job = self.factory.make_testjob(requested_device=device)
-        transaction.commit()
-        DatabaseJobSource().getJobForBoard_impl('panda01')
-        return device, job
+        self.source.getJobForBoard('panda01')
+        return device, TestJob.objects.get(pk=job.pk)
 
     def test_jobCompleted_set_statuses_success(self):
         device, job = self.get_device_and_running_job()
-        transaction.commit()
-        DatabaseJobSource().jobCompleted_impl('panda01', 0)
+        self.source.jobCompleted('panda01', 0)
         job = TestJob.objects.get(pk=job.pk)
         device = Device.objects.get(pk=device.pk)
         self.assertEqual(
@@ -432,8 +494,7 @@
 
     def test_jobCompleted_set_statuses_failure(self):
         device, job = self.get_device_and_running_job()
-        transaction.commit()
-        DatabaseJobSource().jobCompleted_impl('panda01', 1)
+        self.source.jobCompleted('panda01', 1)
         job = TestJob.objects.get(pk=job.pk)
         device = Device.objects.get(pk=device.pk)
         self.assertEqual(
@@ -444,9 +505,8 @@
         device = self.factory.make_device(hostname='panda01')
         job = self.factory.make_testjob(
             requested_device_type=device.device_type)
-        transaction.commit()
-        DatabaseJobSource().getJobForBoard_impl('panda01')
-        DatabaseJobSource().jobCompleted_impl('panda01', 0)
+        self.source.getJobForBoard('panda01')
+        self.source.jobCompleted('panda01', 0)
         job = TestJob.objects.get(pk=job.pk)
         device = Device.objects.get(pk=device.pk)
         self.assertEqual(
@@ -456,25 +516,30 @@
     def test_jobCompleted_sets_end_time(self):
         device, job = self.get_device_and_running_job()
         before = datetime.datetime.now()
-        transaction.commit()
-        DatabaseJobSource().jobCompleted_impl('panda01', 0)
+        self.source.jobCompleted('panda01', 0)
         after = datetime.datetime.now()
         job = TestJob.objects.get(pk=job.pk)
         self.assertTrue(before < job.end_time < after)
 
     def test_jobCompleted_clears_current_job(self):
         device, job = self.get_device_and_running_job()
-        transaction.commit()
-        DatabaseJobSource().jobCompleted_impl('panda01', 0)
+        self.source.jobCompleted('panda01', 0)
         device = Device.objects.get(pk=device.pk)
         self.assertEquals(None, device.current_job)
 
+    def test_jobCompleted_deletes_token(self):
+        device, job = self.get_device_and_running_job()
+        token = job.submit_token
+        self.source.jobCompleted('panda01', 0)
+        self.assertRaises(
+            AuthToken.DoesNotExist,
+            AuthToken.objects.get, pk=token.pk)
+
     def test_getLogFileForJobOnBoard_returns_writable_file(self):
         device, job = self.get_device_and_running_job()
         definition = {'foo': 'bar'}
         self.factory.make_testjob(
             requested_device=device, definition=json.dumps(definition))
-        transaction.commit()
-        log_file = DatabaseJobSource().getLogFileForJobOnBoard_impl('panda01')
+        log_file = self.source.getLogFileForJobOnBoard('panda01')
         log_file.write('a')
         log_file.close()

=== modified file 'lava_scheduler_daemon/dbjobsource.py'
--- lava_scheduler_daemon/dbjobsource.py	2012-01-20 00:23:26 +0000
+++ lava_scheduler_daemon/dbjobsource.py	2012-01-20 03:15:19 +0000
@@ -1,6 +1,7 @@
 import datetime
 import json
 import logging
+import urlparse
 
 from django.core.files.base import ContentFile
 from django.db import connection
@@ -8,6 +9,8 @@
 from django.db.models import Q
 from django.db.utils import DatabaseError
 
+from linaro_django_xmlrpc.models import AuthToken
+
 from twisted.internet.threads import deferToThread
 
 from zope.interface import implements
@@ -15,6 +18,7 @@
 from lava_scheduler_app.models import Device, TestJob
 from lava_scheduler_daemon.jobsource import IJobSource
 
+
 try:
     from psycopg2 import InterfaceError, OperationalError
 except ImportError:
@@ -30,6 +34,8 @@
 
     logger = logging.getLogger(__name__ + '.DatabaseJobSource')
 
+    deferToThread = staticmethod(deferToThread)
+
     def deferForDB(self, func, *args, **kw):
         def wrapper(*args, **kw):
             # If there is no db connection yet on this thread, create a
@@ -38,6 +44,7 @@
             # settings.TIME_ZONE when using postgres (see
             # https://code.djangoproject.com/ticket/17062).
             transaction.enter_transaction_management()
+            transaction.managed()
             try:
                 if connection.connection is None:
                     connection.cursor().close()
@@ -69,7 +76,7 @@
                 # why your south migration appears to have got stuck...
                 transaction.rollback()
                 transaction.leave_transaction_management()
-        return deferToThread(wrapper, *args, **kw)
+        return self.deferToThread(wrapper, *args, **kw)
 
     def getBoardList_impl(self):
         return [d.hostname for d in Device.objects.all()]
@@ -77,6 +84,35 @@
     def getBoardList(self):
         return self.deferForDB(self.getBoardList_impl)
 
+    def _get_json_data(self, job):
+        json_data = json.loads(job.definition)
+        json_data['target'] = job.actual_device.hostname
+        # The rather extreme paranoia in what follows could be much reduced if
+        # we thoroughly validated job data in submit_job.  We don't (yet?)
+        # and there is no sane way to report errors at this stage, so,
+        # paranoia (the dispatcher will choke on bogus input in a more
+        # informative way).
+        if 'actions' not in json_data:
+            return json_data
+        actions = json_data['actions']
+        for action in actions:
+            if not isinstance(action, dict):
+                continue
+            if action.get('command') != 'submit_results':
+                continue
+            params = action.get('parameters')
+            if not isinstance(params, dict):
+                continue
+            params['token'] = job.submit_token.secret
+            if not 'server' in params or not isinstance(params['server'], unicode):
+                continue
+            parsed = urlparse.urlsplit(params['server'])
+            netloc = job.submitter.username + '@' + parsed.hostname
+            parsed = list(parsed)
+            parsed[1] = netloc
+            params['server'] = urlparse.urlunsplit(parsed)
+        return json_data
+
     def getJobForBoard_impl(self, board_name):
         while True:
             device = Device.objects.get(hostname=board_name)
@@ -125,9 +161,9 @@
                 else:
                     job.log_file.save(
                         'job-%s.log' % job.id, ContentFile(''), save=False)
+                    job.submit_token = AuthToken.objects.create(user=job.submitter)
                     job.save()
-                    json_data = json.loads(job.definition)
-                    json_data['target'] = device.hostname
+                    json_data = self._get_json_data(job)
                     transaction.commit()
                     return json_data
             else:
@@ -172,8 +208,12 @@
                 "Unexpected job state in jobCompleted: %s" % job.status)
             job.status = TestJob.COMPLETE
         job.end_time = datetime.datetime.utcnow()
+        token = job.submit_token
+        job.submit_token = None
         device.save()
         job.save()
+        token.delete()
+        transaction.commit()
 
     def jobCompleted(self, board_name, exit_code):
         return self.deferForDB(self.jobCompleted_impl, board_name, exit_code)

