Return a 401 response when /login fails to authenticate using provided credentials

This will allow clients to differentiate between authentication failures and other 500 errors.