More things to test

Check if you can access restricted pages without logging in ...
or after logging out ...
or after timeout expired
logging-in, check good/bad passwords
Upon unsuccessful login, see if the return page does NOT contain the password