allowing basic auth for creating tokens