add test for login with invalid credentials