As per the API specification, when user provides token, she should not be giving username/password. If all has been given result should be 400 Bad Request.