All requests to the server, aside from the request to start a session, must contain a security token which is provided when starting a session successfully.
To authenticate a user, use user credentials in the request body. These credentials include username and password.