This makes no sense. it's either one of (username, password) or token