Your Cisco SE should be able to give you access to dcloud.cisco.com where there are various APIC-EM labs you could demo if that would work for you. You just could not manage your own gear but still get the feel for it.
I noticed some other folks had this problem after upgrading IOS.
Try this
Changed the http login from:
ip http authentication aaa
to
ip http authentication aaa login-authentication default
ip http authentication aaa exec-authorization default
