PASS 01 anonymous /customers is sent to /login
     server says: ASP.NET Core Razor Pages
FAIL 02 login page has a form with a hidden token  <-- 
FAIL 03 wrong password: 401 and one neutral message  <-- 400
PASS 04 login without the token is refused (400 or 403)
FAIL 05 cashier logs in and lands on /customers  <-- 400 None
FAIL 06 all customers: 256 found, first 20 shown  <-- 302
FAIL 07 search 'budi' finds 3  <-- 
FAIL 08 search by phone finds Nabila Rahman  <-- 
FAIL 09 search text is escaped, not executed  <-- 
FAIL 10 SQL typed into the search box is only text  <-- 
FAIL 11 new-bill form is shown to a cashier  <-- 302
FAIL 12 new bill without the token is refused (400 or 403)  <-- 302
FAIL 13 bad bill: 422 and three messages  <-- 302
FAIL 14 good bill: redirect to /bills/<new id>  <-- 302 http://127.0.0.1:9003/login?ReturnUrl=%2Fbills%2Fnew
FAIL 15 bill page: 3 kg express = Rp 36.000, queued, at Rungkut  <-- 200
     created login
FAIL 16 unknown bill: 404  <-- 302
PASS 17 log out, and /customers is closed again
FAIL 18 a washer may not open the new-bill form: 403  <-- 302
3 passed, 15 failed
