General Guidelines on Testing Authentication