API login should be case-agnostic like the web logins are