code cleanup (#2700)

* fix doctrine definition
* do not count api calls as login
* remove unknown form options
* fix annotations
* cleanup deprecations in tests

src/EventSubscriber/LastLoginSubscriber.php

@@ -13,6 +13,7 @@ use App\Entity\User;
 use App\Event\UserInteractiveLoginEvent;
 use App\Repository\UserRepository;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\Security\Guard\Token\PostAuthenticationGuardToken;
 use Symfony\Component\Security\Http\Event\InteractiveLoginEvent;
 use Symfony\Component\Security\Http\SecurityEvents;
 
@@ -46,6 +47,12 @@ class LastLoginSubscriber implements EventSubscriberInterface
 
     public function onSecurityInteractiveLogin(InteractiveLoginEvent $event)
     {
+        // do not count API calls as logins
+        // this point could be used to add API rate limitation in the future
+        if ($event->getAuthenticationToken() instanceof PostAuthenticationGuardToken) {
+            return;
+        }
+
         $user = $event->getAuthenticationToken()->getUser();
 
         if ($user instanceof User) {