I think we should file P2 bug and triage it for this case: if the token endpoint is down, we will force the user to enter credentials