code: function login(username, password, cors = corsAuth, otpToken = null) {
      var auth = 'Basic ' + window.btoa(username + ':' + password);
  
      const headers = {
          'Authorization': auth
      };
      if (_.isString(otpToken)) {
          // Use _.isString to send header with empty string
          headers['Girder-OTP'] = otpToken;
      }
      return restRequest({
          method: 'GET',
          url: '/user/authentication',
          headers: headers,
          error: null
      }).then(function (response) {
          response.user.token = response.authToken;
  
          setCurrentUser(new UserModel(response.user));
          setCurrentToken(response.user.token.token);
  
          if (cors && !cookie.find('girderToken')) {
              // For cross-origin requests, we should write the token into
              // this document's cookie also.
              document.cookie = 'girderToken=' + getCurrentToken();
          }
  
          events.trigger('g:login.success', response.user);
          events.trigger('g:login', response);
  
          return response.user;
      }).fail(function (jqxhr) {
          events.trigger('g:login.error', jqxhr.status, jqxhr);
      });
  }
docs: Log in to the server. If successful, sets the value of currentUser
  and currentToken and triggers the "g:login" and "g:login.success".
  On failure, triggers the "g:login.error" event.
  
  @param username The username or email to login as.
  @param password The password to use.
  @param cors If the girder server is on a different origin, set this
  to "true" to save the auth cookie on the current domain. Alternatively,
  you may set the global option "girder.corsAuth = true".
  @param otpToken An optional one-time password to include with the login.