Craft 3 Element API Authentication/Login
First of all passing the password and username as query strings is one of the most insecure things you can do. It would highly suggest you to not do that unless you want to expose your accounts to everyone with minor knowledge.

Furthermore you are mixing Craft 2 with Craft 3. There is no userSession in Craft 3. I don't want to post a code snipped that would work with the way you are trying since would could eventually copy it without knowing the harm it might cause.

In the end: you should either create some kind of access token, don't pass the params via get request or do something similar. Globally passing sensitive data via url is not clever