username is still required with api_token

(closes GH-51)