fix(controller): check for 400 on failed login