make password/username tests actually fail

we were expecting an exception, but not failing if one wasn't thrown
remove `better-assert`