Account Service should display an error on login failure

Currently, when the Account service posts to / for login, that call gets
intercepted by borderpatrol and borderpatrol makes the call to Account
Service in order to store the token. Currently, on non-success responses
from the Account Service we redirect to the login page.
What we need to do is leave the response to the client un-touched because
the Account Service displays a relevant error page (and in the future,
the login page will displayed again with the relevant error allowing
the user to remedy the situation (i.e they mis-typed their account
credentials)
logically, status is set first, so I'd recommend to move this before setting headers