Handle secrets at the login endpoint

[terjekv]

• Don't log the password for users logging in.
• In the logging of responses, collapse the token returned for working logins.

(Also fixes a type comparison due to ruff changes.)

Fixes #517