User authentication via REST API / OAuth

Hi,

I'm running my own webservice which interacts with my self-hosted community to authenticate users inside a native app running on Windows. Users send their login credentials (mail and password) to the webservice which itself passes the data to the community server for authentication, using OAuth password grant.

Everything works fine, but I have some questions:

1. Why is there no REST API endpoint to authenticate users by mail/password? I have to use OAuth to get an access token, retrieve the user id (core/me) and can then proceed with classic REST calls to get private user data (for example secondary groups). This seems unnecessarily complex, because every time an access token is created which is only used once and never be touched again (token lifetime is set to 1 hour).

2. If the process can not be changed, is there a problem in IPS when there are millions of active access tokens? Are revoked/expired tokens get removed by a cron task automatically?

Kind regards,

Stefan