change to BadRequest which prints the body and error message for bad username/password stuff