[DogeDogeDoge]

Think about the client point of view. It is much better to return "401 Unauthorized" or some other reason rather than 500 .

i would do a case on db:find and proceed to check password if you get user or fail with 401 and same with password case and if its correct go on and if not 401 :)