more sign-in tests; negative scenarios still to be covered