fixing spec

"should fail to login" was broken. the 'bogus'
user is apparently a real user now.