Update API token docs because username is required

Calls with token fail when username is not present. Confusing the way it's currently written