Add apiPost() and fix apiGet() to send the correct headers.
Login functionality.

Add the relevant routes and supporting classes to allow a user to log in to the API using the password grant type.
Remove incorrect comment.
Add true to session_regenerate_id() and also redirect the register action to the legacy app for now.