if (aconf.login.stateless) {
        res.statusCode = statusCode.BAD_REQUEST;
        res.json({result: 'auth mode is stateless'});
        res.end();
    } else {