We have moved authentication to a central domain T348388: SUL3: Use a dedicated domain for login and account creation, which would by default mean that authentication-related APIs on the local domains don't work (or at least not as expected). But we have disabled that to avoid B/C breaks: T379816: Disable SUL3 authentication redirect when using the API

We should gradually undo that, to fully get the security benefits of a separate authentication domain. We should probably start with credentials change, which is more sensitive and less relied on by clients, and then continue with login and signup.