(feat) add 'invalid user' tests