Small correction, I use SSH2 protocol not telnet.
I also added a new username with 15 privilege in the web GUI. It got me in via SSH2 directly into enable mode. One step forward, however, still want the prior user authentication first for extra security.
Here's where I'm stuck now.
Cisco3650#conf t Enter configuration commands, one per line. End with CNTL/Z. Cisco3650(config)#line vty 0 4 Cisco3650(config-line)#login local ^% Invalid input detected at '^' marker.