incorrect username/pass cause 400 BAD REQUEST (exception handler created); password field is @JsonIgnore in User entity
nothing important