fixes #1

As the credentials are passed as the 'option' parameter, the property app_id is ambigous (as it can be used in the URL) and therefore isn't sufficient to decide that one is using the app authentication. Ensuring that the token is present too is a simple way to grant that.