add test for login failure