don't send both basic auth and bearer token