added "POST /users/<username>/auth"