adds test for POST without a valid user