Authenticates user and returns access token. For web clients, sets httpOnly refresh token cookie. For mobile/desktop clients, returns refreshToken in response body.
Client type determines how refresh tokens are returned:
web, mobile, desktop Login successful