I was incorrect when I stated I got the curl request to work using URI parameters to provide email and password. This does not work and the response I received was due to having guest access enabled, not actually instantiating a valid session for the given user.
Credentials (email, password) must be provided as part of the body of the request, not in the URI. E.g., in JSON,
{ "email": "jeffrey@dreamfactory.com", "password": "12345" }
I installed Postman and tested with the above, and it worked. No URI parameters involved.
Wiki page for reference on including email and password in body instead of URI:
https://github.com/dreamfactorysoftware/dsp-core/wiki/User-Profile-Management