Handle invalid login without returning 500

Handle invalid login without returning an HTTP 500 internal server
error.

Signed-off-by: Jeff Godin <jgodin@tadl.org>