/oauth2/token endpoint and passwordless login