login() now returns false with invalid credentials (3.2)