Yes, you can call the login without any permissions.

You can read more on how to implement for web apps in the usage for web applications section.

https://github.com/greenart7c3/Amber#usage-for-web-applications