Login plugins that want to signal an authentication error should return 401 and display the auth form for the user to retry. Returing a 200 makes it impossible to script checks and is the incorrect thing to do anyway as browser may decide to store invalid credentials if a 200 is returned.
This issue ticket was originally removed from the tracker as it clashed with the pull request. See upstream ticket for migration details.
Metadata Update from @t0xic0der: - Issue close_status updated to: Fixed - Issue status updated to: Closed (was: Open)