Email and password for now. The same JWT response is what Expo will store later. Magic-link is stubbed on the API.