introduce new status, now PSTATUS_BAD_LOGIN_DATA is only for when username/password is bad, and PSTATUS_BAD_LOGIN_TOKEN is for expired token