add spec for invalid security code