token auth uses form post instead of basic auth for initial login