Steps to reproduce:

1. Call the API 'user.login' and a wrong password with curl or any other tool
2. The API returns 200, and a field "error" in JSON

Expected:

• The API should returns 403 when the authentication fails.