Return 400 when login fails