MAJOR: webservices will only accept auth with webservices token, not user's password