title: Which HTTP status code to say username or password were incorrect?
body: <p>I am implementing a simple registation/login module.</p>
  
  <p>While testing user credentials, I start thinking which HTTP status code will be appropriate, for the situation if a user send a request with incorrect credentials.</p>
  
  <p>At first, I thought 401 Unauthorized would be a nice status code, but it seems it will be better to use it when a user is trying to get some resource without authorisation.</p>
  
  <p>After, I switched to 409 Conflict</p>
  
  <blockquote>
    <p>This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request.</p>
  </blockquote>
  
  <p>So, friends, please give me an advise, which status code should be used. </p>