The duplicate login issue has been fixed on the server side and a second login attempt will generate an error. You can see this error on the server side but due to AEROGEAR-1074 the correct error page (AeroGear Controllers default error page as there is not "catch all" error route for the TODO app) will not be found and a 404 will be returned. But even with the fix for AEROGEAR-1074 this will not help this use case as the response needs to be returned in JSON format.
Adding a general "catch all" error route that produces JSON would produces the following for the second login attempt:

status: 400,
statusText: "Bad Request",
responseJSON: Object
    error: "active user: john provided credentials: [johnnnnyyyyyysdsadsd]"

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira