added missing 'incorrect password' test