@Test(expected = AuthenticationException.class)
public void aValidUserWithAnInvalidPasswordShouldntBeAbleToConnect(User user) {

    // Given
    given(userDao.findByUsername(A_VALID_USER)).willReturn(user);
    given(passwordSecurity.check(anyString(), anyString())).willReturn(false);
    // When
    authenticator.authenticateCredentials(A_VALID_USER, AN_INVALID_PASSWORD);
    // Then
    verify(httpSession, never()).setAttribute(anyString(), any());
}