Hello,
I put same question in Github, DreamFactory repository, and get answer from Todd Appleton (dreamfactory dev) and get this answer:
The UI is a little confusing. There's an implicit assumption that if you don't want to require email confirmation you should unset 'Open Reg Email Service' in Services-->User-->Config. Set it to empty (no selection). Your first example with login=true should then return a session token.
I tested and works fine.
Best regards,
LB