Curl. Bad request. No token or api key provided. On login

because you're not logging in with that call.
you're accessing the mongodb service and trying to append user/session to the end of it. Mongodb service requires an api key and/or session token to operate.
If you want to use sessions, you need to POST user/session first. Then take the session token and use it in your subsequent calls (which will need both a token and an api key)