Update token with basic public auth, no extra permissions.