use proper HTTP status for /login response