reject empty passphrases
added more login tests
added create_user_with_rsvp() helper for testing.