Update to return a 401 on invalid.

lib/api.js

@@ -438,7 +438,7 @@ app.post('/authenticate', function (req, res) {
     let hmac = crypto.createHmac('sha256', global.config.api.secKey).update(req.body.password).digest('hex');
     global.mysql.query("SELECT * FROM users WHERE username = ? AND ((pass IS null AND email = ?) OR (pass = ?))", [req.body.username, req.body.password, hmac]).then(function (rows) {
         if (rows.length === 0) {
-            return res.json({'success': false, msg: 'Invalid username/password'});
+            return res.status(401).send({'success': false, msg: 'Invalid username/password'});
         }
         let token = jwt.sign({id: rows[0].id, admin: rows[0].admin}, global.config.api.secKey, {expiresIn: '1d'});
         return res.json({'success': true, 'msg': token});