PetStore sample sets bad example for loginUser call

The UserApi.loginUser call from the PetStore sample passes the username and password on the query string. From this reference: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

RESTful web services should use session-based authentication, either by establishing a session
token via a POST or by using an API key as a POST body argument or as a cookie. Usernames,
passwords, session tokens, and API keys should not appear in the URL, as this can be captured
in web server logs, which makes them intrinsically valuable.

OK:
https://example.com/resourceCollection/<id>/action
https://twitter.com/vanderaj/lists

NOT OK:
https://example.com/controller/<id>/action?apiKey=a53f435643de32 (API Key in URL)
http://example.com/controller/<id>/action?apiKey=a53f435643de32 (transaction not protected by TLS; API Key in URL)

I know that this is just a sample meant to demonstrate various features of swagger including the different ways of specifying parameters. However, I believe a lot of people starting to write their own API might start from the sample and therefore the sample should follow best practices.

I suggest that the loginUser call simply POST the parameters and to use some other functionality for GET parameters in the query string.

Start with the PetStore sample and locate the UserApi.loginUser operation. Review how its username and password parameters are defined and generated, then update the sample so credentials are sent in the POST body rather than the query string. Confirm the generated API behavior and ensure another sample still demonstrates query-string parameters.