The route never returns status 401.

The code lets any user log in as long as the email exists.

The code uses bcrypt correctly to compare a password with its hash.

bcrypt.compare here compares two plaintext passwords.