wrote tests for User.fetch() with no password