Add Basic Auth to POST /tokens to let the user get the same token for the same user:password

"use it to derive the key"