POST to /db/_session should fail if username doesn’t exist

Note that I made the response status be 404 instead of 401.
Fixes #226.