Have server stuff setup right, user can login and get 200 (HTTP/OK) if their credentials are correct, or 403(HTTP/FORBIDDEN) if they login incorrectly