added a bad token spec and fixed password field
fixed destroy