make the PasswordNotFoundException publicly available -- there are some cases where it is useful for client classes to create these same exception types
add more test coverage