Redo tests of FinishAssertionSteps step 6

[GitHub issue #451][1] describes an edge case in the assertion verification
logic for when the username in the request does not map to any credentials, and
therefore cannot be mapped to a user handle. This change redoes the tests of
this logic with a clearer structure, and expands the tests with coverage for
this edge case.

[1]: #451

Author: emlun