Use token for every call besides username/pwd login