I always believe /login served by a browser and /login for api should never be the same, to echo your statement they require different handler. It should be two

I always believe /login served by a browser and /login for api should never be the same, to echo your statement they require different handler. It should be two completely different view; but those views call the same login function internally. Perhaps /login is a bad example, but use that in views where authentication and authorization are needed.