Correctly handle disallowed logins.

test_oauth/views.py

 from django.shortcuts import redirect
-from django.contrib import auth
+from django.contrib import auth, messages
 from django.views.decorators.cache import never_cache
 from django.conf import settings
 
@@ -29,6 +29,11 @@ def callback(request):
         .fetch_token(code=request.GET['code'])
     )
 
-    auth.login(request, auth.authenticate(token=token))
+    user = auth.authenticate(token=token)
+
+    if user is not None:
+        auth.login(request, user)
+    else:
+        messages.error(request, 'Login failed.')
 
     return redirect(getattr(settings, 'TEST_OAUTH_REDIRECT', '/'))