Authenticate with an email and password and receive an access_token to send as the Authorization header on subsequent requests. If the user already holds a valid token it is returned as-is rather than a new one being issued; tokens are valid for 30 days from last use. Returns 401 if the credentials are incorrect.