Fix: need to follow order of Accept preferences

The previous commit broke the browser, because all responses would be JSON.  This fixes that.

lib/helpers/handle-accept-request.js

@@ -44,7 +44,10 @@ function handleAcceptRequest(req, res, handlers, fallbackHandler) {
   // always override with the SPA handler if SPA is enabled.
   var handler;
 
-  allowedResponseTypes.some(function (contentType) {
+  accepted.some(function (contentType) {
+    if (allowedResponseTypes.indexOf(contentType) === -1) {
+      return false;
+    }
     if (config.web.spa.enabled && contentType === 'text/html') {
       handler = spaResponseHandler(config);
       return true;

test/fixtures/produces-fixture.js

@@ -35,6 +35,9 @@ ProducesFixture.prototype.getEndpointWithAccept = function getEndpointWithAccept
     .get(stormpathConfig.web.login.uri)
     .set('Accept', acceptString);
 };
+ProducesFixture.prototype.requestAsBrowser = function requestAsBrowser() {
+  return this.getEndpointWithAccept('text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8');
+};
 ProducesFixture.prototype.requestAsJson = function requestAsJson() {
   return this.getEndpointWithAccept('application/json');
 };

test/produces.js

@@ -38,6 +38,11 @@ describe('produces option', function () {
         fixture.requestAsJson().end(fixture.assertJsonResponse(done));
       });
     });
+    describe('and Accept is a browser default', function () {
+      it('should respond with HTML', function (done) {
+        fixture.requestAsBrowser().end(fixture.assertHtmlResponse(done));
+      });
+    });
     describe('and request has no Accept header', function () {
       it('should respond with JSON (the first item in the produces list)', function (done) {
         fixture.requestWithoutAcceptHeader().end(fixture.assertJsonResponse(done));
@@ -90,6 +95,12 @@ describe('produces option', function () {
       });
     });
 
+    describe('and Accept is a browser default', function () {
+      it('should respond with HTML', function (done) {
+        fixture.requestAsBrowser().end(fixture.assertHtmlResponse(done));
+      });
+    });
+
     describe('and request has no Accept header', function () {
       it('should respond with HTML', function (done) {
         fixture.requestAsHtml().end(fixture.assertHtmlResponse(done));