Clarify that POST /api/login is used for API key creation