that literally shows my point, it uses GET to get data about the currently logged in user, which you need a token for in the headers

Logs you into an account. (Returns an authorization token)

POST /session

After you do this, you can GET the info about already logged in user(that login used POST. I quoted its docs)