async login() {
    const username = this.getRequiredArg('username')
    const password = this.getRequiredArg('password')
    const authType = this.getIntArg('authType', constant.AuthType.PASSWORD)
    if (config.consoleLoginWithCaptcha) {
      const cid = this.getRequiredArg('cid');
      const captchaText = this.getRequiredArg('captchaText')
      const {valid, errmsg} = await captchaValidate(cid, captchaText)
      if (!valid) {
        this.fail(200, errmsg);
        return
      }
    }

    this.log4js.info('### user[%s] login authType=%s...', username, authType)
    const {userInfo, err: loginErr} = await this.userLoginInternal(username, password, {authType})

    if (loginErr) {
      this.fail(200, loginErr)
      return
    }

    if (!(userInfo.manager === constant.Manager.super || userInfo.manager === constant.Manager.admin)) {
      this.log4js.error('login failed! user:%s have no permission to login the rbac console', username)
      throw new AccessDenyError('ERR_LOGIN_NEED_SUPER_OR_ADMIN')
    }

    const {token} = await this.tokenCreate(userInfo)
    this.log4js.info('username: %s, token: %s', username, token)

    let applications = await this.userApplications(userInfo);
    userInfo.appIDs = userInfo.appIDs || []

    const data = {token, 'userInfo': util.filterFieldWhite(userInfo, userFields), applications}
    this.success(data)
  }
backend user login
@request
@return json