This is a mock login for local development: any username is accepted as-is, becomes the token's sub claim, and no password is checked. Never point a real client at this with real credentials.
sub