Return 401 instead of 404 when user with given loginToken is not found.
If loginToken is presented, make sure its a valid one.