login should return error messages instead of 503