bug in login route. should return status 401 if user authentication fails