add cucumbers for sign in feature

This doesn't seem correct. How can a user sign in if the sign-in feature is disabled? As written, this scenario should always fail. "When I visit the MAS website" maybe? Negative testing is weird.