fix multiple tokens bug

Only look for valid Token when authenticating with username / password