IdentityServer4 + ASP.NET core API + Angular: Login/authentication

I'm using IdentityServer4 to handle authentication and authorization in my ASP.NET core API. I use angular4 on client side. I know that I can use token endpoint (http://myapidomain/connect/token) to get access_token by using grantype = ResourceOwnerPassword. It means that I provide username and password in login UI to authenticate.

My question is: do we need to implement API Account/Login anymore? I think that IdentityServer4 is already handle signin via cookie authentication middleware automatically. If we need to implement API Account/Login. What is best practice to implement that. I read somewhere is that use this for login

await  HttpContext.Authentication.SignInAsync(identityUser.Id,                                                                             identityUser.UserName);

and this for logout

await HttpContext.Authentication.SignOutAsync

The second question of mine is: When I get access_token from connect/token. I try to get userinfo by access http://myapidomain/connect/userinfo. But I always get 405 error code. What are my missing

in angular client

authFormHeaders() {
    const header = new Headers();
    header.append('Content-Type', 'application/x-www-form-urlencoded; charset=utf-8');
    header.append('Accept', 'application/json');
    header.append('Authorization', 'Bearer ' + this.oidcSecurityCommon.getAccessToken());
    return header;
  }

getUserInfo() {
        let self = this;
        let options = new RequestOptions({
            method: RequestMethod.Get,
            headers: this.authService.authFormHeaders()
        });
        return self.http.get(this.authWellKnownEndpoints.userinfoEndpoint, options)
            .map((res: Response) => {
                return res.json();
            })
            .catch(self.appService.handleError);
    }

in my API server side:

CorsPolicyBuilder corsBuilder = new CorsPolicyBuilder()
                .AllowAnyHeader()
                .AllowAnyMethod()
                .AllowAnyOrigin()
                .AllowCredentials();
            services.AddCors(opts =>
            {
                opts.AddPolicy("AllowAllOrigins", corsBuilder.Build());
            });

var url = optionsAccessor.Value.SystemConfig.Authority;
            app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
            {
                Authority = url,
                RequireHttpsMetadata = false,
                ApiName = "netpower.qms.saas.api"/*,
                AllowedScopes = { IdentityServerConstants.StandardScopes.OpenId }*/
            });
app.UseCors("AllowAllOrigins");