Handle authentication by POST
No sensitive variables in error reporting
Switch to POST for API
Add test for POST in backend_provider
Only one ApplicationToken by client