faulty login goes to /session instead of producing error