test auth service behaviour when login fails