Use token in addition to user/pass