login/pass: allow token instead of login