accept USERNAME and PASSWORD instead of TOKEN