Session token basic auth working