“There are verbs in the URL” – wrong.
Try to write here example how to authenticate user by login and password without having verb in API.