The login handler now returns a response