verify username is present and is valid, display auth 401 if not, and the inline token (/tokens POST) if checks pass. issue #1