Add passcode tests!

Along the way, refine some small AccountModel nits, including testing on
the result of .getLoginState(), rather than testing its existence.