add tests with different (wrong) credentials

add tests run with
- a valid username,but wrong pw
- wrong username and pw

add checks to all test to except 403 when wrong
credentials are supplied