Add HTTPServletRequest to /api/login.

So it will pass Spring security filter.