/authenticate changed to /login. /login end-point fixed so it doesn't try to send two responses.