"There are verbs in the URL" - wrong.
Try to write here example how to authenticate user by login and password without having verb in API.