Use the login resource to authenticate

Some providers do not expose the "root" api endpoint, so it should be
better not used to get the token. The login resource can be used
instead.