Added 401 return on password failure, and some options to remove hard coded paths.