scenario: attempt to log in with invalid credentials