Use login if we don't have a rawLogin.

They are the same except when they’re not.
Use the rawLogin in the authorization header.