C-S /login response does not require any fields

It seems rather bizarre that `access_token` and `user_id` at least are not required in a /login response.

Start by locating the Matrix specification section that defines the Client-Server /login response and inspect its required fields. Determine whether access_token and user_id are mandatory in that response, then update the specification schema or wording accordingly; done means the /login response clearly requires both fields.

Written by the indexing model from the issue text.