Maybe you bot has the right page but read permission is needed for login api call which makes no sense.
Is there any white list to enable the login api call?
Try to login with use_api_login = False in your user_config but I am not sure whether this still works with mw >= 1.18
Regards
xqt