Any login, password = web/settings password (or master password). 401
carries WWW-Authenticate so browsers/Postman prompt. X-Api-Key still
works for existing integrations. Docs warn that over plain HTTP the
password travels in every request.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>