add username and password fields to /token path, closes 349