Login should use the app secret / key, and post the user credentials.