Feature: auth.login() allows optional API key