RestApi: OAuth2
Security: fixed direct logins - User::login(NULL, NULL, IIdentity)