After reading this description of the problem and other users' comments about insufficient testing and how hard it would be to discover this particular case, I

After reading this description of the problem and other users' comments about insufficient testing and how hard it would be to discover this particular case, I must say I'm baffled. As the blog post shows, the account creation is done on the first click, not the second. The second just logs you in. A trivial test in this case would have been, try to log in with a non-existing account (or an account with the wrong password) and make sure no state has changed afterwards. No new users, no changed passwords, everything as it was. Unit testing 101.