refactor specs related to AJAX password verification