login1 has a separate ActivateSession request, so put it here so that we don't have to modify any backend code.
We're going to replace this with a login1 implementation soon enough.