Let basic_auth and token_auth disable each other

Only one authentication method is needed. Using both can potentially
confuse two-factor authentication.
Add tests around the basic_auth/token_auth changes

Ensure the behavior is observed in the tests so this does not regress.
Merge branch 'pr/197' into develop