Don't log a user in by default.
login accepts username and either apikey or password.
Logging in returns true or false.

This allows the application decide whether or not to proceeed.