Prevent 401 on main admin page

[BlackDex]

When you are not loggedin, and have no cookie etc.. we always returned a 401. This was mainly to allow the login page on all the sub pages, and after login being redirected to the requested page, for these pages a 401 is a valid response, since, you do not have access.

But for the main /admin page, it should just respond with a 200 and show the login page.

This PR fixes this flow and response. It should prevent people using Fail2ban, or other tools being triggered by only accessing the login page.

Resolves #3540

[tessus]

Yep, this shows a 200 now. Cheers.

Btw, do you know, whether there is a standard after trying to login? Currently a 401 is returned, which I believe is fine. But I have also seen 200s. e.g. try to login to github with a wrong user/password. The browser still gets a 200.
I am just wondering, because I have seen these things all over the place. (IMO the worst is to have an API return 404, when the API does not find an element. The API itself should return a 200 status code, but the error code in the response should be a 404. Anyway, off topic.)
Just wondering what your take on this is.

[BlackDex]

Yep, this shows a 200 now. Cheers.

Btw, do you know, whether there is a standard after trying to login? Currently a 401 is returned, which I believe is fine. But I have also seen 200s. e.g. try to login to github with a wrong user/password. The browser still gets a 200. I am just wondering, because I have seen these things all over the place. (IMO the worst is to have an API return 404, when the API does not find an element. The API itself should return a 200 status code, but the error code in the response should be a 404. Anyway, off topic.) Just wondering what your take on this is.

Well, a 401 should be used if the login is invalid, either when trying to access a page which needs authentication, or when sending your credentials and they are invalid. A 200 is OK, and invalid credentials, or accessing a page which you do not have access to, is not OK in my opinion.

If you build some kind of API, and return a 200 for invalid login, that would mean you need to scrape the body to see if you are logged in or not? That is bad in my opinion.