add deferred close of client for create-token
cleanup
cleanup and use req.setBasicAuth()