Status code should be 200 even if password is wrong
(otherwise defaults to 201 created in POST endpoints)