To allow users additional login attempts we need to return status 401 instead of 400 on login failure.