diff --git a/framework/test/flask_servlet_test.py b/framework/test/flask_servlet_test.py
new file mode 100644
index 0000000..443f919
--- /dev/null
+++ b/framework/test/flask_servlet_test.py
@@ -0,0 +1,108 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file or at
+# https://developers.google.com/open-source/licenses/bsd
+"""Unit tests for servlet base class module."""
+from __future__ import print_function
+from __future__ import division
+from __future__ import absolute_import
+
+import time
+import mock
+import unittest
+import logging
+
+from google.appengine.ext import testbed
+
+from framework import flaskservlet, framework_constants, servlet_helpers
+from framework import xsrf
+from proto import project_pb2
+from proto import tracker_pb2
+from proto import user_pb2
+from services import service_manager
+from testing import fake
+from testing import testing_helpers
+
+
+class TestableFlaskServlet(flaskservlet.FlaskServlet):
+  """A tiny concrete subclass of abstract class Servlet."""
+
+  def __init__(self, services=None, do_post_redirect=True):
+    super(TestableFlaskServlet, self).__init__(services=services)
+    self.do_post_redirect = do_post_redirect
+    self.seen_post_data = None
+
+
+class FlaskServletTest(unittest.TestCase):
+
+  def setUp(self):
+    services = service_manager.Services(
+        project=fake.ProjectService(),
+        project_star=fake.ProjectStarService(),
+        user=fake.UserService(),
+        usergroup=fake.UserGroupService())
+    services.user.TestAddUser('user@example.com', 111)
+    self.page_class = flaskservlet.FlaskServlet(services=services)
+    self.testbed = testbed.Testbed()
+    self.testbed.activate()
+    self.testbed.init_user_stub()
+    self.testbed.init_memcache_stub()
+    self.testbed.init_datastore_v3_stub()
+
+  def tearDown(self):
+    self.testbed.deactivate()
+
+  def testDefaultValues(self):
+    self.assertEqual(None, self.page_class._MAIN_TAB_MODE)
+    self.assertTrue(self.page_class._TEMPLATE_PATH.endswith('/templates/'))
+    self.assertEqual(None, self.page_class._PAGE_TEMPLATE)
+
+  @mock.patch('flask.abort')
+  def testCheckForMovedProject_NoRedirect(self, mock_abort):
+    project = fake.Project(
+        project_name='proj', state=project_pb2.ProjectState.LIVE)
+    request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj', project=project)
+    self.page_class._CheckForMovedProject(mr, request)
+    mock_abort.assert_not_called()
+
+    request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj/source/browse/p/adminAdvanced', project=project)
+    self.page_class._CheckForMovedProject(mr, request)
+    mock_abort.assert_not_called()
+
+  @mock.patch('flask.abort')
+  def testCheckForMovedProject_Redirect(self, mock_abort):
+    project = fake.Project(project_name='proj', moved_to='http://example.com')
+    request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj', project=project)
+    self.page_class._CheckForMovedProject(mr, request)
+    mock_abort.assert_called_once_with(302)
+
+  def testGatherBaseData(self):
+    project = self.page_class.services.project.TestAddProject(
+        'testproj', state=project_pb2.ProjectState.LIVE)
+    project.cached_content_timestamp = 12345
+
+    (_request, mr) = testing_helpers.GetRequestObjects(
+        path='/p/testproj/feeds', project=project)
+    nonce = '1a2b3c4d5e6f7g'
+
+    base_data = self.page_class.GatherBaseData(mr, nonce)
+
+    self.assertEqual(base_data['nonce'], nonce)
+    self.assertEqual(base_data['projectname'], 'testproj')
+    self.assertEqual(base_data['project'].cached_content_timestamp, 12345)
+    self.assertEqual(base_data['project_alert'], None)
+
+    self.assertTrue(base_data['currentPageURL'].endswith('/p/testproj/feeds'))
+    self.assertTrue(
+        base_data['currentPageURLEncoded'].endswith('%2Fp%2Ftestproj%2Ffeeds'))
+
+  def testGatherHelpData_Normal(self):
+    project = fake.Project(project_name='proj')
+    _request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj', project=project)
+    help_data = self.page_class.GatherHelpData(mr, {})
+    self.assertEqual(None, help_data['cue'])
+    self.assertEqual(None, help_data['account_cue'])
diff --git a/framework/test/servlet_helpers_test.py b/framework/test/servlet_helpers_test.py
index a2fe687..19f4ea4 100644
--- a/framework/test/servlet_helpers_test.py
+++ b/framework/test/servlet_helpers_test.py
@@ -9,6 +9,7 @@
 from __future__ import absolute_import
 
 import unittest
+import settings
 
 from google.appengine.ext import testbed
 
@@ -75,6 +76,16 @@
         permissions.PermissionException,
         servlet_helpers.AssertBasePermission, mr)
 
+  def testPermForProject(self):
+    project = project_pb2.Project()
+    project.project_name = 'proj'
+    project.access = project_pb2.ProjectAccess.MEMBERS_ONLY
+    _, mr = testing_helpers.GetRequestObjects(path='/p/proj/', project=project)
+    mr.auth.user_pb.email = settings.borg_service_account
+    project_perm = servlet_helpers.CheckPermForProject(
+        mr, permissions.CREATE_GROUP, project)
+    self.assertTrue(project_perm)
+
 
 FORM_URL = 'http://example.com/issues/form.php'
 
@@ -110,10 +121,7 @@
     self.config.custom_issue_entry_url = FORM_URL
 
     url = servlet_helpers.ComputeIssueEntryURL(mr, self.config)
-    self.assertTrue(url.startswith(FORM_URL))
-    self.assertIn('token=', url)
-    self.assertIn('role=', url)
-    self.assertIn('continue=', url)
+    self.assertIn('/issues/wizard', url)
 
 class IssueListURLTest(unittest.TestCase):
 
@@ -166,3 +174,60 @@
 
     url = servlet_helpers.IssueListURL(mr, self.config, query_string='q=Pri=1')
     self.assertEqual('/p/proj/issues/list?q=Pri=1', url)
+
+class ProjectIsRestrictedTest(unittest.TestCase):
+
+  def setUp(self):
+    self.project = project_pb2.Project()
+    self.project.project_name = 'proj'
+    self.config = tracker_pb2.ProjectIssueConfig()
+    self.testbed = testbed.Testbed()
+    self.testbed.activate()
+    self.testbed.init_user_stub()
+    self.testbed.init_memcache_stub()
+    self.testbed.init_datastore_v3_stub()
+
+  def tearDown(self):
+    self.testbed.deactivate()
+
+  def testProjectIsRestricted(self):
+    self.project.access = project_pb2.ProjectAccess.MEMBERS_ONLY
+    _request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj/issues/detail?id=123&q=term', project=self.project)
+    isRestrict = servlet_helpers.ProjectIsRestricted(mr)
+    self.assertTrue(isRestrict)
+
+  def testProjectIsNotRestricted(self):
+    self.project.access = project_pb2.ProjectAccess.ANYONE
+    _request, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj/issues/detail?id=123&q=term', project=self.project)
+    isRestrict = servlet_helpers.ProjectIsRestricted(mr)
+    self.assertFalse(isRestrict)
+
+
+class ComputerCreateUrl(unittest.TestCase):
+
+  def setUp(self):
+    self.project = project_pb2.Project()
+    self.project.project_name = 'proj'
+    self.config = tracker_pb2.ProjectIssueConfig()
+    self.testbed = testbed.Testbed()
+    self.testbed.activate()
+    self.testbed.init_user_stub()
+    self.testbed.init_memcache_stub()
+    self.testbed.init_datastore_v3_stub()
+
+  def tearDown(self):
+    self.testbed.deactivate()
+
+  def testCreateLoginUrl(self):
+    _, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj/issues/detail?id=123&q=term', project=self.project)
+    url = servlet_helpers.SafeCreateLoginURL(mr, '/continue')
+    self.assertIn('/continue', url)
+
+  def testCreateLogoutUrl(self):
+    _, mr = testing_helpers.GetRequestObjects(
+        path='/p/proj/issues/detail?id=123&q=term', project=self.project)
+    url = servlet_helpers.SafeCreateLogoutURL(mr)
+    self.assertIn('/Logout', url)
diff --git a/framework/test/servlet_test.py b/framework/test/servlet_test.py
index 40d5ed2..694e493 100644
--- a/framework/test/servlet_test.py
+++ b/framework/test/servlet_test.py
@@ -17,7 +17,7 @@
 
 import webapp2
 
-from framework import framework_constants
+from framework import framework_constants, servlet_helpers
 from framework import servlet
 from framework import xsrf
 from proto import project_pb2
@@ -227,23 +227,23 @@
     project = fake.Project(
         project_name='alerttest', state=project_pb2.ProjectState.LIVE)
 
-    project_alert = servlet._CalcProjectAlert(project)
+    project_alert = servlet_helpers.CalcProjectAlert(project)
     self.assertEqual(project_alert, None)
 
     project.state = project_pb2.ProjectState.ARCHIVED
-    project_alert = servlet._CalcProjectAlert(project)
+    project_alert = servlet_helpers.CalcProjectAlert(project)
     self.assertEqual(
         project_alert,
         'Project is archived: read-only by members only.')
 
     delete_time = int(time.time() + framework_constants.SECS_PER_DAY * 1.5)
     project.delete_time = delete_time
-    project_alert = servlet._CalcProjectAlert(project)
+    project_alert = servlet_helpers.CalcProjectAlert(project)
     self.assertEqual(project_alert, 'Scheduled for deletion in 1 day.')
 
     delete_time = int(time.time() + framework_constants.SECS_PER_DAY * 2.5)
     project.delete_time = delete_time
-    project_alert = servlet._CalcProjectAlert(project)
+    project_alert = servlet_helpers.CalcProjectAlert(project)
     self.assertEqual(project_alert, 'Scheduled for deletion in 2 days.')
 
   def testCheckForMovedProject_NoRedirect(self):
@@ -441,10 +441,10 @@
 
     proj.access = project_pb2.ProjectAccess.ANYONE
     proj.state = project_pb2.ProjectState.LIVE
-    self.assertFalse(servlet._ProjectIsRestricted(mr))
+    self.assertFalse(servlet_helpers.ProjectIsRestricted(mr))
 
     proj.state = project_pb2.ProjectState.ARCHIVED
-    self.assertFalse(servlet._ProjectIsRestricted(mr))
+    self.assertFalse(servlet_helpers.ProjectIsRestricted(mr))
 
   def testRestrictedProject(self):
     proj = project_pb2.Project()
@@ -453,14 +453,15 @@
 
     proj.state = project_pb2.ProjectState.LIVE
     proj.access = project_pb2.ProjectAccess.MEMBERS_ONLY
-    self.assertTrue(servlet._ProjectIsRestricted(mr))
+    self.assertTrue(servlet_helpers.ProjectIsRestricted(mr))
+
 
 class VersionBaseTest(unittest.TestCase):
 
   @mock.patch('settings.local_mode', True)
   def testLocalhost(self):
     request = webapp2.Request.blank('/', base_url='http://localhost:8080')
-    actual = servlet._VersionBaseURL(request)
+    actual = servlet_helpers.VersionBaseURL(request)
     expected = 'http://localhost:8080'
     self.assertEqual(expected, actual)
 
@@ -469,6 +470,6 @@
   def testProd(self, mock_gdvh):
     mock_gdvh.return_value = 'monorail-prod.appspot.com'
     request = webapp2.Request.blank('/', base_url='https://bugs.chromium.org')
-    actual = servlet._VersionBaseURL(request)
+    actual = servlet_helpers.VersionBaseURL(request)
     expected = 'https://test-dot-monorail-prod.appspot.com'
     self.assertEqual(expected, actual)