[ci skip] [skip ci]
This fixes a regression from #1843 and #1854. Now, the frontend again shows the proper "Incorrect login details" message instead of "You do not have permission to do that".
Decouple from implementation, test closer to HTTP...