TODO Find a good way to make it configurable on a per-environment basis.

401 is for resources that require authentication, and login endpoint does not require authentication. Login endpoint forbids access with invalid credentials, so it should report 403 Forbidden.

Additionaly, browsers show login popup when XHR gets 401 with WWW-Authenticate in response, which is not something that we want to happen.