That needs to be fixed then; this API should only accept the email parameter. With the code as-is, I can still log in as myself, then pretend to be you by visiting http://example.org/user/ksedge, because ksedge is a valid username in the login API.