Sessions guest

Email address and password. A personal access token (pat_…) or session token (token-…) may also be sent in the password field, with any non-empty value as the username — a blank username short-circuits to a 401 before the token is read.