style nitpick, the new try_to_login tests below use `refute` - might as well be consistent...