updating test to use let and fakers

Actually this test works correctly. 
If a user tries to log in with a good email address and bad password, the user will be found in the database, but they won't be logged in.