new token from basic auth
adding specs for bad credentials
skipping calls when basic auth isn't used