added /api/login and error messages for authentication