Login page gets user token from session authenticate endpoint.