Add failure test cases

server.js

@@ -23,11 +23,15 @@ var server = Hapi.createServer(bind.host, bind.port, settings);
 server.addRoutes(routes);
 
 server.ext(
-	'onPreResponse',
-	function (request, next) {
-		request.response().header("Strict-Transport-Security", "max-age=10886400");
-		next();
-	}
+  'onPreResponse',
+  function (request, next) {
+    var res = request.response();
+    // error responses don't have `header`
+    if (res.header) {
+      res.header("Strict-Transport-Security", "max-age=10886400");
+    }
+    next();
+  }
 );
 
 module.exports = server;

test/integration/account.js

@@ -30,6 +30,21 @@ describe('user', function() {
     });
   });
 
+
+  it('should fail to login with an unknown email', function(done) {
+    testClient.makeRequest('POST', '/startLogin', {
+      payload: { email: 'bad@emai.l' }
+    }, function(res) {
+      try {
+        assert.equal(res.statusCode, 404);
+        assert.equal(res.result.message, 'UnknownUser');
+      } catch (e) {
+        return done(e);
+      }
+      done();
+    });
+  });
+
   it('should begin login', function(done) {
     testClient.makeRequest('POST', '/startLogin', {
       payload: { email: TEST_EMAIL }
@@ -45,6 +60,40 @@ describe('user', function() {
     });
   });
 
+  it('should fail to login with a bad password', function(done) {
+    testClient.makeRequest('POST', '/finishLogin', {
+      payload: {
+        sessionId: sessionId,
+        password: 'bad pass'
+      }
+    }, function(res) {
+      try {
+        assert.equal(res.statusCode, 400);
+        assert.equal(res.result.message, 'IncorrectPassword');
+      } catch (e) {
+        return done(e);
+      }
+      done();
+    });
+  });
+
+  it('should fail to login with an unknown sessionId', function(done) {
+    testClient.makeRequest('POST', '/finishLogin', {
+      payload: {
+        sessionId: 'bad sessionid',
+        password: TEST_PASSWORD
+      }
+    }, function(res) {
+      try {
+        assert.equal(res.statusCode, 404);
+        assert.equal(res.result.message, 'UnknownSession');
+      } catch (e) {
+        return done(e);
+      }
+      done();
+    });
+  });
+
   it('should finish login', function(done) {
     testClient.makeRequest('POST', '/finishLogin', {
       payload: {