login: indicate failure in http status codes