app_spec additions & changes

Combined login and logout tests

Added tests against HTML injection