AF-37: Expose login locations via REST