code: function authenticate ({username, password, clientToken, agent}) {
    return fetch(`${YGGDRASIL_API}/authenticate`, {
      method: 'POST',
      body: JSON.stringify({
        agent,
        username,
        password,
        clientToken,
        requestUser: true
      }),
      headers: {
        'user-agent': USER_AGENT,
        'Content-Type': 'application/json',
        'accept': 'application/json'
      }
    })
      .then(handleErrors)
      .then(res => res.json())
  }
docs: Authenticates a user with their Mojang credentials.
  
  *Use `agent` if session is for a game client, ie. a Minecraft launcher.*
  
  **Handle access tokens securely, but they do invalidate easily.**
  
  @param {Object} credentials - the payload of the auth request
  @param {string} credentials.username - email or username of a Mojang account
  @param {string} credentials.password - password for the given account
  @param {string=} credentials.clientToken - if empty, server will generate a client token
  @param {Object=} credentials.agent - if valid, adds `selectedProfile` to response
  @param {string} credentials.agent.name - name of the agent ('Minecraft' or 'Scrolls')
  @param {number} credentials.agent.version - version number of the agent (use `1`)
  @returns {Promise<MojangSession>} resolves if credentials are valid
  @see {@link http://wiki.vg/Authentication#Authenticate}
  @example
  const clientToken = 'loaded from settings'
  const agent = {name: 'Minecraft', version: 1}
  const session = await mojang.authenticate({username, password, clientToken, agent})
  console.debug('access token', session.accessToken)
  console.debug('profile id', session.selectedProfile.id)
  console.debug('minecraft ign', session.selectedProfile.name)
  console.debug('user id', session.user.id)