Login and User Information Requests
Just few quick things come to my mind:


The way try/catch is used is to exit on error, which would happen anyway. Maybe you need to send some info to the user here instead.
Are you passing raw user input to the database, without validation? This would be clear security issue.
Why not if($user) instead of if($user != FALSE)?
What is the purpose to set headers and then exit without any request?