test for login failure & validate Authorization header sent to server