minor Auth tweaking

if token exist, try authanticating based on token
else or if token is invalid, use the password