I think the better solution for a web page login form specifically is to disable the button "onPressDown", so this error path is impossible.

For users with JS disabled, your solution seems good.

The correct action is to disable the button while the request is in flight so it can't be clicked a second time. Otherwise you won't see "user already logged in", because the user won't be logged in until the previous request returns (a race condition).