Fix incorrect args and request method

[radishmouse]

While investigating #407, I noticed that the API call to auth/oidc/authenticate was incorrect.

• Updated both the caller and the route to POST.
• Removed unused headers.

Side note:
I haven't looked into it, but I suspect that the headers are added by oidc-client-ts and our api.call() function automatically includes the headers.

The backend automatically extracts and uses the auth token from the headers via the requireOIDCAuth middleware.

[aaspinwall]

Nice catch! We definitely should change get to post but I think we should split the difference and keep the authorization token on the post request. Since the header is getting requested and sent, it means it's not contained in the api store yet.

[radishmouse]

Nice catch! We definitely should change get to post but I think we should split the difference and keep the authorization token on the post request. Since the header is getting requested and sent, it means it's not contained in the api store yet.

I think this needs some more investigation-
Something is already adding the token to the header on outgoing requests (maybe the oidc-client-ts library, when we call userManager.signinCallback()).

Meaning, the backend is able to extract and validate the auth token, even if we don't pass it as an argument to api.call()

I definitely prefer it being explicit (passing it to api.call()), but I also don't want to pretend like that's actually where the token is coming from.

I'll look more closely at what's happening with oidc-client-ts and follow up.

[radishmouse]

@aaspinwall I've restored the header w/token.
So the only real change in this PR is fixing the arguments and changing the request type (on the client and on the server) for the route.