fixed login to always return BAD_CREDENTIALS on failure