try token and fallback to asking for login info