I've just discovered that on DW 9 the POST /dwapi/users/authenticate only accepts credentials in it's query just like get GET method which is very unsafe.
If I POST with a JSON body I get 405 Method Not Allowed - isn't that a mistake that the POST method hasn't been updated with a JSON body like DW10 has?
