are we testing #validate_credentials here?  If so, we should say

    should "properly validate the credentials"