Login endpoint optionally takes form-urlencoded, as well as JSON.