Let basic_auth and token_auth disable each other

Only one authentication method is needed. Using both can potentially
confuse two-factor authentication.