attempts to authenticate via token before password