This request does not require to log in, as described in „Basics“
/rest/auth
username=foo&password=bar
The parameter username equals the field username in the staff view, not the field name.
FAIL
<?xml version="1.0" encoding="UTF-8"?> <xml> <id>1</id> <staff_name>Foo Bar</staff_name> ... </xml>