return correct response code on failed authentication
skip authenticity token
added test for invalid credentials
Merge pull request #7 from Team-Moar/merch-auth

Merch auth