login failure now returns {}, which json can parse