Separate login service/routes
Responses should respect the http_code of the error that produced them