Yes, test the negative case as well. eg if you get the system setup so you can log in, also make sure you get permission denied for bad login info.