We may still have a response that has JSON in it if it's a bad password.