WIP - drop basic_auth in favor of api_token in url