Add Basic Auth to POST /tokens to let the user get the same token for the same user:password

Yes it is probably a good idea.