adding invalid cases to .authenticate (user-specs)