should NOT give http 200 OK response for failed logins.

[divinity76]

perhaps 400 Bad Request or 403 Forbidden or 422 Unprocessable Entity , but definitely not 200 OK (which is generated by default if nothing else is specified)