Authenticates user and returns access token. For web clients, sets httpOnly refresh token cookie. For mobile/desktop/server clients, returns refreshToken in response body.
Client type determines how refresh tokens are returned:
web, mobile, desktop, server Login successful