Both token and http basic auth #18