add spec to test wrong password at login