Did you test the `response == null` branch? I believe login returns either error or a valid access token, never a null response.