that literally shows my point, it uses GET to get data about the currently logged in user, which you need a token for in the headers
and it uses POST for auth
Logs you into an account. (Returns an authorization token)
POST /session
After you do this, you can GET the info about already logged in user(that login used POST. I quoted its docs)
huh. I also used GET /session
hmmm