Under 2.1, this worked fine for me passing the _username and _password in the URL.
I upgraded to 2.2. I’m using LDAP for my auth. Using the same local user, I set a secret. When I use the URL constructed with _secret, I get the login form - no other errors or feedback.
Interestingly, if I pass an incorrect secret, I get the method not allowed error message instead of nothing.
Aaaand 2.2 broke iframes including it in a smashing dashboard with the content security policy modifications. CSP has changed so my additional conf file with CSP edits wasn’t working. Now I’m through that and back to trying to get the autologin working.