add tests for invalid user