Calls your API: POST /auth/login. Expect accessToken (or token) + user.