What is the accepted practice for URL login in API REST?

If I have: users, and I need to log in with api rest. What's the best way to do it?

1 /users/id/password

2 /users?id=id&password=pass

If I use the second option, I will need to validate if there are get parameters. If not, It will return all results.

This is not the answer I want now: REST API Login Pattern