It would be nice to return a json with some info to the user, about wrong username or password. Maybe worth throwing a 401 Unauthorized exception?