HTTP response code

**Is your feature request related to a problem? Please describe.**
I don't find an option to activate HTTP response codes for invalid logins/mfa failures. I would expect 4xx response codes. Reason for this would be rate limiting on the reverse proxy if a client fails x-times in y-minutes

**Describe the solution you'd like**
An option to activate response codes other than 200 for failures

**Describe alternatives you've considered**
It's of course possible to scan the response body on the reverse proxy and search for code: "invalid" or similar in the JSON object

**Additional context**
This would be helpful to block brute force attacks. It's easier to configure it via the HTTP response code instead of parsing the response body.