diff --git a/samples/IdentitySample.Mvc/IdentitySample.Mvc.xproj b/samples/IdentitySample.Mvc/IdentitySample.Mvc.xproj
index 13b00b9794..659b35e899 100644
--- a/samples/IdentitySample.Mvc/IdentitySample.Mvc.xproj
+++ b/samples/IdentitySample.Mvc/IdentitySample.Mvc.xproj
@@ -12,7 +12,7 @@
   </PropertyGroup>
   <PropertyGroup>
     <SchemaVersion>2.0</SchemaVersion>
-    <DevelopmentServerPort>5131</DevelopmentServerPort>
+    <DevelopmentServerPort>41532</DevelopmentServerPort>
   </PropertyGroup>
   <Import Project="$(VSToolsPath)\DNX\Microsoft.DNX.targets" Condition="'$(VSToolsPath)' != ''" />
 </Project>
\ No newline at end of file
diff --git a/src/Microsoft.AspNet.Identity/SecurityStampValidator.cs b/src/Microsoft.AspNet.Identity/SecurityStampValidator.cs
index 7b9ae17c39..ba9b6d7ca7 100644
--- a/src/Microsoft.AspNet.Identity/SecurityStampValidator.cs
+++ b/src/Microsoft.AspNet.Identity/SecurityStampValidator.cs
@@ -30,7 +30,9 @@ namespace Microsoft.AspNet.Identity
             var user = await manager.ValidateSecurityStampAsync(context.Principal, userId);
             if (user != null)
             {
-                await manager.SignInAsync(user, context.Properties, authenticationMethod: null);
+                // REVIEW: note we lost login authenticaiton method
+                context.ReplacePrincipal(await manager.CreateUserPrincipalAsync(user));
+                context.ShouldRenew = true;
             }
             else
             {
diff --git a/test/Microsoft.AspNet.Identity.InMemory.Test/FunctionalTest.cs b/test/Microsoft.AspNet.Identity.InMemory.Test/FunctionalTest.cs
index 74c56ce9c0..fd53910d12 100644
--- a/test/Microsoft.AspNet.Identity.InMemory.Test/FunctionalTest.cs
+++ b/test/Microsoft.AspNet.Identity.InMemory.Test/FunctionalTest.cs
@@ -1,332 +1,330 @@
-//// Copyright (c) .NET Foundation. All rights reserved.
-//// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-//using System;
-//using System.IO;
-//using System.Linq;
-//using System.Net;
-//using System.Net.Http;
-//using System.Security.Claims;
-//using System.Text;
-//using System.Threading.Tasks;
-//using System.Xml;
-//using System.Xml.Linq;
-//using Microsoft.AspNet.Builder;
-//using Microsoft.AspNet.Http;
-//using Microsoft.AspNet.Http.Authentication;
-//using Microsoft.AspNet.Http.Features.Authentication;
-//using Microsoft.AspNet.TestHost;
-//using Microsoft.Framework.DependencyInjection;
-//using Shouldly;
-//using Xunit;
-//using Microsoft.AspNet.Identity.Test;
-//using System.Diagnostics;
+using System;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Claims;
+using System.Text;
+using System.Threading.Tasks;
+using System.Xml;
+using System.Xml.Linq;
+using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.Http;
+using Microsoft.AspNet.Http.Authentication;
+using Microsoft.AspNet.Http.Features.Authentication;
+using Microsoft.AspNet.TestHost;
+using Microsoft.Framework.DependencyInjection;
+using Shouldly;
+using Xunit;
+using Microsoft.AspNet.Identity.Test;
 
-//namespace Microsoft.AspNet.Identity.InMemory
-//{
-//    public class FunctionalTest
-//    {
-//        const string TestPassword = "1qaz!QAZ";
+namespace Microsoft.AspNet.Identity.InMemory
+{
+    public class FunctionalTest
+    {
+        const string TestPassword = "1qaz!QAZ";
 
-//        [Fact]
-//        public async Task CanChangePasswordOptions()
-//        {
-//            var clock = new TestClock();
-//            var server = CreateServer(services => services.ConfigureIdentity(options =>
-//            {
-//                options.Password.RequireUppercase = false;
-//                options.Password.RequireNonLetterOrDigit = false;
-//                options.Password.RequireDigit = false;
-//            }));
+        [Fact]
+        public async Task CanChangePasswordOptions()
+        {
+            var clock = new TestClock();
+            var server = CreateServer(services => services.ConfigureIdentity(options =>
+            {
+                options.Password.RequireUppercase = false;
+                options.Password.RequireNonLetterOrDigit = false;
+                options.Password.RequireDigit = false;
+            }));
 
-//            var transaction1 = await SendAsync(server, "http://example.com/createSimple");
-//            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.Null(transaction1.SetCookie);
-//        }
+            var transaction1 = await SendAsync(server, "http://example.com/createSimple");
+            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.Null(transaction1.SetCookie);
+        }
 
-//        [Fact]
-//        public async Task CanCreateMeLoginAndCookieStopsWorkingAfterExpiration()
-//        {
-//            var clock = new TestClock();
-//            var server = CreateServer(services => services.ConfigureIdentityApplicationCookie(appCookieOptions =>
-//            {
-//                appCookieOptions.SystemClock = clock;
-//                appCookieOptions.ExpireTimeSpan = TimeSpan.FromMinutes(10);
-//                appCookieOptions.SlidingExpiration = false;
-//            }));
+        [Fact]
+        public async Task CanCreateMeLoginAndCookieStopsWorkingAfterExpiration()
+        {
+            var clock = new TestClock();
+            var server = CreateServer(services => services.ConfigureIdentityApplicationCookie(appCookieOptions =>
+            {
+                appCookieOptions.SystemClock = clock;
+                appCookieOptions.ExpireTimeSpan = TimeSpan.FromMinutes(10);
+                appCookieOptions.SlidingExpiration = false;
+            }));
 
-//            var transaction1 = await SendAsync(server, "http://example.com/createMe");
-//            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.Null(transaction1.SetCookie);
+            var transaction1 = await SendAsync(server, "http://example.com/createMe");
+            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.Null(transaction1.SetCookie);
 
-//            var transaction2 = await SendAsync(server, "http://example.com/pwdLogin/false");
-//            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.NotNull(transaction2.SetCookie);
-//            transaction2.SetCookie.ShouldNotContain("; expires=");
+            var transaction2 = await SendAsync(server, "http://example.com/pwdLogin/false");
+            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.NotNull(transaction2.SetCookie);
+            transaction2.SetCookie.ShouldNotContain("; expires=");
 
-//            var transaction3 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            FindClaimValue(transaction3, ClaimTypes.Name).ShouldBe("hao");
-//            Assert.Null(transaction3.SetCookie);
+            var transaction3 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            FindClaimValue(transaction3, ClaimTypes.Name).ShouldBe("hao");
+            Assert.Null(transaction3.SetCookie);
 
-//            clock.Add(TimeSpan.FromMinutes(7));
+            clock.Add(TimeSpan.FromMinutes(7));
 
-//            var transaction4 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            FindClaimValue(transaction4, ClaimTypes.Name).ShouldBe("hao");
-//            Assert.Null(transaction4.SetCookie);
+            var transaction4 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            FindClaimValue(transaction4, ClaimTypes.Name).ShouldBe("hao");
+            Assert.Null(transaction4.SetCookie);
 
-//            clock.Add(TimeSpan.FromMinutes(7));
+            clock.Add(TimeSpan.FromMinutes(7));
 
-//            var transaction5 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            FindClaimValue(transaction5, ClaimTypes.Name).ShouldBe(null);
-//            Assert.Null(transaction5.SetCookie);
-//        }
+            var transaction5 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            FindClaimValue(transaction5, ClaimTypes.Name).ShouldBe(null);
+            Assert.Null(transaction5.SetCookie);
+        }
 
-//        [Theory]
-//        [InlineData(true)]
-//        [InlineData(false)]
-//        public async Task CanCreateMeLoginAndSecurityStampExtendsExpiration(bool rememberMe)
-//        {
-//            var clock = new TestClock();
-//            var server = CreateServer(services => services.ConfigureIdentityApplicationCookie(appCookieOptions =>
-//            {
-//                appCookieOptions.SystemClock = clock;
-//            }));
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task CanCreateMeLoginAndSecurityStampExtendsExpiration(bool rememberMe)
+        {
+            var clock = new TestClock();
+            var server = CreateServer(services => services.ConfigureIdentityApplicationCookie(appCookieOptions =>
+            {
+                appCookieOptions.SystemClock = clock;
+            }));
 
-//            var transaction1 = await SendAsync(server, "http://example.com/createMe");
-//            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.Null(transaction1.SetCookie);
+            var transaction1 = await SendAsync(server, "http://example.com/createMe");
+            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.Null(transaction1.SetCookie);
 
-//            var transaction2 = await SendAsync(server, "http://example.com/pwdLogin/" + rememberMe);
-//            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.NotNull(transaction2.SetCookie);
-//            if (rememberMe)
-//            {
-//                transaction2.SetCookie.ShouldContain("; expires=");
-//            }
-//            else
-//            {
-//                transaction2.SetCookie.ShouldNotContain("; expires=");
-//            }
+            var transaction2 = await SendAsync(server, "http://example.com/pwdLogin/" + rememberMe);
+            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.NotNull(transaction2.SetCookie);
+            if (rememberMe)
+            {
+                transaction2.SetCookie.ShouldContain("; expires=");
+            }
+            else
+            {
+                transaction2.SetCookie.ShouldNotContain("; expires=");
+            }
 
-//            var transaction3 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            FindClaimValue(transaction3, ClaimTypes.Name).ShouldBe("hao");
-//            Assert.Null(transaction3.SetCookie);
+            var transaction3 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            FindClaimValue(transaction3, ClaimTypes.Name).ShouldBe("hao");
+            Assert.Null(transaction3.SetCookie);
 
-//            // Make sure we don't get a new cookie yet
-//            clock.Add(TimeSpan.FromMinutes(10));
-//            var transaction4 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            FindClaimValue(transaction4, ClaimTypes.Name).ShouldBe("hao");
-//            Assert.Null(transaction4.SetCookie);
+            // Make sure we don't get a new cookie yet
+            clock.Add(TimeSpan.FromMinutes(10));
+            var transaction4 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            FindClaimValue(transaction4, ClaimTypes.Name).ShouldBe("hao");
+            Assert.Null(transaction4.SetCookie);
 
-//            // Go past SecurityStampValidation interval and ensure we get a new cookie
-//            clock.Add(TimeSpan.FromMinutes(21));
+            // Go past SecurityStampValidation interval and ensure we get a new cookie
+            clock.Add(TimeSpan.FromMinutes(21));
 
-//            var transaction5 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
-//            Assert.NotNull(transaction5.SetCookie);
-//            FindClaimValue(transaction5, ClaimTypes.Name).ShouldBe("hao");
+            var transaction5 = await SendAsync(server, "http://example.com/me", transaction2.CookieNameValue);
+            Assert.NotNull(transaction5.SetCookie);
+            FindClaimValue(transaction5, ClaimTypes.Name).ShouldBe("hao");
 
-//            // Make sure new cookie is valid
-//            var transaction6 = await SendAsync(server, "http://example.com/me", transaction5.CookieNameValue);
-//            FindClaimValue(transaction6, ClaimTypes.Name).ShouldBe("hao");
-//        }
+            // Make sure new cookie is valid
+            var transaction6 = await SendAsync(server, "http://example.com/me", transaction5.CookieNameValue);
+            FindClaimValue(transaction6, ClaimTypes.Name).ShouldBe("hao");
+        }
 
-//        [Fact]
-//        public async Task TwoFactorRememberCookieVerification()
-//        {
-//            var server = CreateServer();
+        [Fact]
+        public async Task TwoFactorRememberCookieVerification()
+        {
+            var server = CreateServer();
 
-//            var transaction1 = await SendAsync(server, "http://example.com/createMe");
-//            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//            Assert.Null(transaction1.SetCookie);
+            var transaction1 = await SendAsync(server, "http://example.com/createMe");
+            transaction1.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            Assert.Null(transaction1.SetCookie);
 
-//            var transaction2 = await SendAsync(server, "http://example.com/twofactorRememeber");
-//            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+            var transaction2 = await SendAsync(server, "http://example.com/twofactorRememeber");
+            transaction2.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
 
-//            string setCookie = transaction2.SetCookie;
-//            setCookie.ShouldContain(IdentityOptions.TwoFactorRememberMeCookieAuthenticationScheme + "=");
-//            setCookie.ShouldContain("; expires=");
+            string setCookie = transaction2.SetCookie;
+            setCookie.ShouldContain(IdentityOptions.TwoFactorRememberMeCookieAuthenticationScheme + "=");
+            setCookie.ShouldContain("; expires=");
 
-//            var transaction3 = await SendAsync(server, "http://example.com/isTwoFactorRememebered", transaction2.CookieNameValue);
-//            transaction3.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
-//        }
+            var transaction3 = await SendAsync(server, "http://example.com/isTwoFactorRememebered", transaction2.CookieNameValue);
+            transaction3.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        }
 
-//        private static string FindClaimValue(Transaction transaction, string claimType)
-//        {
-//            var claim = transaction.ResponseElement.Elements("claim").SingleOrDefault(elt => elt.Attribute("type").Value == claimType);
-//            if (claim == null)
-//            {
-//                return null;
-//            }
-//            return claim.Attribute("value").Value;
-//        }
+        private static string FindClaimValue(Transaction transaction, string claimType)
+        {
+            var claim = transaction.ResponseElement.Elements("claim").SingleOrDefault(elt => elt.Attribute("type").Value == claimType);
+            if (claim == null)
+            {
+                return null;
+            }
+            return claim.Attribute("value").Value;
+        }
 
-//        private static async Task<XElement> GetAuthData(TestServer server, string url, string cookie)
-//        {
-//            var request = new HttpRequestMessage(HttpMethod.Get, url);
-//            request.Headers.Add("Cookie", cookie);
+        private static async Task<XElement> GetAuthData(TestServer server, string url, string cookie)
+        {
+            var request = new HttpRequestMessage(HttpMethod.Get, url);
+            request.Headers.Add("Cookie", cookie);
 
-//            HttpResponseMessage response2 = await server.CreateClient().SendAsync(request);
-//            string text = await response2.Content.ReadAsStringAsync();
-//            XElement me = XElement.Parse(text);
-//            return me;
-//        }
+            HttpResponseMessage response2 = await server.CreateClient().SendAsync(request);
+            string text = await response2.Content.ReadAsStringAsync();
+            XElement me = XElement.Parse(text);
+            return me;
+        }
 
-//        private static TestServer CreateServer(Action<IServiceCollection> configureServices = null, Func<HttpContext, Task> testpath = null, Uri baseAddress = null)
-//        {
-//            var server = TestServer.Create(app =>
-//            {
-//                app.UseIdentity();
-//                app.Use(async (context, next) =>
-//                {
-//                    var req = context.Request;
-//                    var res = context.Response;
-//                    var userManager = context.RequestServices.GetRequiredService<UserManager<TestUser>>();
-//                    var signInManager = context.RequestServices.GetRequiredService<SignInManager<TestUser>>();
-//                    PathString remainder;
-//                    if (req.Path == new PathString("/normal"))
-//                    {
-//                        res.StatusCode = 200;
-//                    }
-//                    else if (req.Path == new PathString("/createMe"))
-//                    {
-//                        var result = await userManager.CreateAsync(new TestUser("hao"), TestPassword);
-//                        res.StatusCode = result.Succeeded ? 200 : 500;
-//                    }
-//                    else if (req.Path == new PathString("/createSimple"))
-//                    {
-//                        var result = await userManager.CreateAsync(new TestUser("simple"), "aaaaaa");
-//                        res.StatusCode = result.Succeeded ? 200 : 500;
-//                    }
-//                    else if (req.Path == new PathString("/protected"))
-//                    {
-//                        res.StatusCode = 401;
-//                    }
-//                    else if (req.Path.StartsWithSegments(new PathString("/pwdLogin"), out remainder))
-//                    {
-//                        var isPersistent = bool.Parse(remainder.Value.Substring(1));
-//                        var result = await signInManager.PasswordSignInAsync("hao", TestPassword, isPersistent, false);
-//                        res.StatusCode = result.Succeeded ? 200 : 500;
-//                    }
-//                    else if (req.Path == new PathString("/twofactorRememeber"))
-//                    {
-//                        var user = await userManager.FindByNameAsync("hao");
-//                        await signInManager.RememberTwoFactorClientAsync(user);
-//                        res.StatusCode = 200;
-//                    }
-//                    else if (req.Path == new PathString("/isTwoFactorRememebered"))
-//                    {
-//                        var user = await userManager.FindByNameAsync("hao");
-//                        var result = await signInManager.IsTwoFactorClientRememberedAsync(user);
-//                        res.StatusCode = result ? 200 : 500;
-//                    }
-//                    else if (req.Path == new PathString("/twofactorSignIn"))
-//                    {
-//                    }
-//                    else if (req.Path == new PathString("/me"))
-//                    {
-//                        var auth = new AuthenticateContext("Application");
-//                        Debugger.Launch();
-//                        auth.Authenticated(context.User, new AuthenticationProperties().Items, new AuthenticationDescription().Items);
-//                        Describe(res, auth);
-//                    }
-//                    else if (req.Path.StartsWithSegments(new PathString("/me"), out remainder))
-//                    {
-//                        var auth = new AuthenticateContext(remainder.Value.Substring(1));
-//                        await context.Authentication.AuthenticateAsync(auth);
-//                        Describe(res, auth);
-//                    }
-//                    else if (req.Path == new PathString("/testpath") && testpath != null)
-//                    {
-//                        await testpath(context);
-//                    }
-//                    else
-//                    {
-//                        await next();
-//                    }
-//                });
-//            },
-//            services =>
-//            {
-//                services.AddIdentity<TestUser, TestRole>();
-//                services.AddSingleton<IUserStore<TestUser>, InMemoryUserStore<TestUser>>();
-//                services.AddSingleton<IRoleStore<TestRole>, InMemoryRoleStore<TestRole>>();
-//                if (configureServices != null)
-//                {
-//                    configureServices(services);
-//                }
-//            });
-//            server.BaseAddress = baseAddress;
-//            return server;
-//        }
+        private static TestServer CreateServer(Action<IServiceCollection> configureServices = null, Func<HttpContext, Task> testpath = null, Uri baseAddress = null)
+        {
+            var server = TestServer.Create(app =>
+            {
+                app.UseIdentity();
+                app.Use(async (context, next) =>
+                {
+                    var req = context.Request;
+                    var res = context.Response;
+                    var userManager = context.RequestServices.GetRequiredService<UserManager<TestUser>>();
+                    var signInManager = context.RequestServices.GetRequiredService<SignInManager<TestUser>>();
+                    PathString remainder;
+                    if (req.Path == new PathString("/normal"))
+                    {
+                        res.StatusCode = 200;
+                    }
+                    else if (req.Path == new PathString("/createMe"))
+                    {
+                        var result = await userManager.CreateAsync(new TestUser("hao"), TestPassword);
+                        res.StatusCode = result.Succeeded ? 200 : 500;
+                    }
+                    else if (req.Path == new PathString("/createSimple"))
+                    {
+                        var result = await userManager.CreateAsync(new TestUser("simple"), "aaaaaa");
+                        res.StatusCode = result.Succeeded ? 200 : 500;
+                    }
+                    else if (req.Path == new PathString("/protected"))
+                    {
+                        res.StatusCode = 401;
+                    }
+                    else if (req.Path.StartsWithSegments(new PathString("/pwdLogin"), out remainder))
+                    {
+                        var isPersistent = bool.Parse(remainder.Value.Substring(1));
+                        var result = await signInManager.PasswordSignInAsync("hao", TestPassword, isPersistent, false);
+                        res.StatusCode = result.Succeeded ? 200 : 500;
+                    }
+                    else if (req.Path == new PathString("/twofactorRememeber"))
+                    {
+                        var user = await userManager.FindByNameAsync("hao");
+                        await signInManager.RememberTwoFactorClientAsync(user);
+                        res.StatusCode = 200;
+                    }
+                    else if (req.Path == new PathString("/isTwoFactorRememebered"))
+                    {
+                        var user = await userManager.FindByNameAsync("hao");
+                        var result = await signInManager.IsTwoFactorClientRememberedAsync(user);
+                        res.StatusCode = result ? 200 : 500;
+                    }
+                    else if (req.Path == new PathString("/twofactorSignIn"))
+                    {
+                    }
+                    else if (req.Path == new PathString("/me"))
+                    {
+                        var auth = new AuthenticateContext("Application");
+                        auth.Authenticated(context.User, new AuthenticationProperties().Items, new AuthenticationDescription().Items);
+                        Describe(res, auth);
+                    }
+                    else if (req.Path.StartsWithSegments(new PathString("/me"), out remainder))
+                    {
+                        var auth = new AuthenticateContext(remainder.Value.Substring(1));
+                        await context.Authentication.AuthenticateAsync(auth);
+                        Describe(res, auth);
+                    }
+                    else if (req.Path == new PathString("/testpath") && testpath != null)
+                    {
+                        await testpath(context);
+                    }
+                    else
+                    {
+                        await next();
+                    }
+                });
+            },
+            services =>
+            {
+                services.AddIdentity<TestUser, TestRole>();
+                services.AddSingleton<IUserStore<TestUser>, InMemoryUserStore<TestUser>>();
+                services.AddSingleton<IRoleStore<TestRole>, InMemoryRoleStore<TestRole>>();
+                if (configureServices != null)
+                {
+                    configureServices(services);
+                }
+            });
+            server.BaseAddress = baseAddress;
+            return server;
+        }
 
-//        private static void Describe(HttpResponse res, AuthenticateContext result)
-//        {
-//            res.StatusCode = 200;
-//            res.ContentType = "text/xml";
-//            var xml = new XElement("xml");
-//            if (result != null && result.Principal != null)
-//            {
-//                xml.Add(result.Principal.Claims.Select(claim => new XElement("claim", new XAttribute("type", claim.Type), new XAttribute("value", claim.Value))));
-//            }
-//            if (result != null && result.Properties != null)
-//            {
-//                xml.Add(result.Properties.Select(extra => new XElement("extra", new XAttribute("type", extra.Key), new XAttribute("value", extra.Value))));
-//            }
-//            using (var memory = new MemoryStream())
-//            {
-//                using (var writer = new XmlTextWriter(memory, Encoding.UTF8))
-//                {
-//                    xml.WriteTo(writer);
-//                }
-//                res.Body.Write(memory.ToArray(), 0, memory.ToArray().Length);
-//            }
-//        }
+        private static void Describe(HttpResponse res, AuthenticateContext result)
+        {
+            res.StatusCode = 200;
+            res.ContentType = "text/xml";
+            var xml = new XElement("xml");
+            if (result != null && result.Principal != null)
+            {
+                xml.Add(result.Principal.Claims.Select(claim => new XElement("claim", new XAttribute("type", claim.Type), new XAttribute("value", claim.Value))));
+            }
+            if (result != null && result.Properties != null)
+            {
+                xml.Add(result.Properties.Select(extra => new XElement("extra", new XAttribute("type", extra.Key), new XAttribute("value", extra.Value))));
+            }
+            using (var memory = new MemoryStream())
+            {
+                using (var writer = new XmlTextWriter(memory, Encoding.UTF8))
+                {
+                    xml.WriteTo(writer);
+                }
+                res.Body.Write(memory.ToArray(), 0, memory.ToArray().Length);
+            }
+        }
 
-//        private static async Task<Transaction> SendAsync(TestServer server, string uri, string cookieHeader = null, bool ajaxRequest = false)
-//        {
-//            var request = new HttpRequestMessage(HttpMethod.Get, uri);
-//            if (!string.IsNullOrEmpty(cookieHeader))
-//            {
-//                request.Headers.Add("Cookie", cookieHeader);
-//            }
-//            if (ajaxRequest)
-//            {
-//                request.Headers.Add("X-Requested-With", "XMLHttpRequest");
-//            }
-//            var transaction = new Transaction
-//            {
-//                Request = request,
-//                Response = await server.CreateClient().SendAsync(request),
-//            };
-//            if (transaction.Response.Headers.Contains("Set-Cookie"))
-//            {
-//                transaction.SetCookie = transaction.Response.Headers.GetValues("Set-Cookie").SingleOrDefault();
-//            }
-//            if (!string.IsNullOrEmpty(transaction.SetCookie))
-//            {
-//                transaction.CookieNameValue = transaction.SetCookie.Split(new[] { ';' }, 2).First();
-//            }
-//            transaction.ResponseText = await transaction.Response.Content.ReadAsStringAsync();
+        private static async Task<Transaction> SendAsync(TestServer server, string uri, string cookieHeader = null, bool ajaxRequest = false)
+        {
+            var request = new HttpRequestMessage(HttpMethod.Get, uri);
+            if (!string.IsNullOrEmpty(cookieHeader))
+            {
+                request.Headers.Add("Cookie", cookieHeader);
+            }
+            if (ajaxRequest)
+            {
+                request.Headers.Add("X-Requested-With", "XMLHttpRequest");
+            }
+            var transaction = new Transaction
+            {
+                Request = request,
+                Response = await server.CreateClient().SendAsync(request),
+            };
+            if (transaction.Response.Headers.Contains("Set-Cookie"))
+            {
+                transaction.SetCookie = transaction.Response.Headers.GetValues("Set-Cookie").SingleOrDefault();
+            }
+            if (!string.IsNullOrEmpty(transaction.SetCookie))
+            {
+                transaction.CookieNameValue = transaction.SetCookie.Split(new[] { ';' }, 2).First();
+            }
+            transaction.ResponseText = await transaction.Response.Content.ReadAsStringAsync();
 
-//            if (transaction.Response.Content != null &&
-//                transaction.Response.Content.Headers.ContentType != null &&
-//                transaction.Response.Content.Headers.ContentType.MediaType == "text/xml")
-//            {
-//                transaction.ResponseElement = XElement.Parse(transaction.ResponseText);
-//            }
-//            return transaction;
-//        }
+            if (transaction.Response.Content != null &&
+                transaction.Response.Content.Headers.ContentType != null &&
+                transaction.Response.Content.Headers.ContentType.MediaType == "text/xml")
+            {
+                transaction.ResponseElement = XElement.Parse(transaction.ResponseText);
+            }
+            return transaction;
+        }
 
-//        private class Transaction
-//        {
-//            public HttpRequestMessage Request { get; set; }
-//            public HttpResponseMessage Response { get; set; }
+        private class Transaction
+        {
+            public HttpRequestMessage Request { get; set; }
+            public HttpResponseMessage Response { get; set; }
 
-//            public string SetCookie { get; set; }
-//            public string CookieNameValue { get; set; }
+            public string SetCookie { get; set; }
+            public string CookieNameValue { get; set; }
 
-//            public string ResponseText { get; set; }
-//            public XElement ResponseElement { get; set; }
-//        }
-//    }
-//}
+            public string ResponseText { get; set; }
+            public XElement ResponseElement { get; set; }
+        }
+    }
+}
diff --git a/test/Microsoft.AspNet.Identity.Test/SecurityStampValidatorTest.cs b/test/Microsoft.AspNet.Identity.Test/SecurityStampValidatorTest.cs
index 2a514c3135..9c4636d230 100644
--- a/test/Microsoft.AspNet.Identity.Test/SecurityStampValidatorTest.cs
+++ b/test/Microsoft.AspNet.Identity.Test/SecurityStampValidatorTest.cs
@@ -44,20 +44,22 @@ namespace Microsoft.AspNet.Identity.Test
             var httpContext = new Mock<HttpContext>();
             var contextAccessor = new Mock<IHttpContextAccessor>();
             contextAccessor.Setup(a => a.HttpContext).Returns(httpContext.Object);
+            var id = new ClaimsIdentity(IdentityOptions.ApplicationCookieAuthenticationScheme);
+            id.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id));
+            var principal = new ClaimsPrincipal(id);
+
             var properties = new AuthenticationProperties { IssuedUtc = DateTimeOffset.UtcNow, IsPersistent = isPersistent };
             var signInManager = new Mock<SignInManager<TestUser>>(userManager.Object,
                 contextAccessor.Object, claimsManager.Object, options.Object, null);
             signInManager.Setup(s => s.ValidateSecurityStampAsync(It.IsAny<ClaimsPrincipal>(), user.Id)).ReturnsAsync(user).Verifiable();
-            signInManager.Setup(s => s.SignInAsync(user, properties, null)).Returns(Task.FromResult(0)).Verifiable();
+            signInManager.Setup(s => s.CreateUserPrincipalAsync(user)).ReturnsAsync(principal).Verifiable();
             var services = new ServiceCollection();
             services.AddInstance(options.Object);
             services.AddInstance(signInManager.Object);
             services.AddInstance<ISecurityStampValidator>(new SecurityStampValidator<TestUser>());
             httpContext.Setup(c => c.RequestServices).Returns(services.BuildServiceProvider());
-            var id = new ClaimsIdentity(IdentityOptions.ApplicationCookieAuthenticationScheme);
-            id.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id));
 
-            var ticket = new AuthenticationTicket(new ClaimsPrincipal(id), 
+            var ticket = new AuthenticationTicket(principal, 
                 properties, 
                 IdentityOptions.ApplicationCookieAuthenticationScheme);
             var context = new CookieValidatePrincipalContext(httpContext.Object, ticket, new CookieAuthenticationOptions());