A token and a username/password are two different logins; which one is meant
can't be told, so a client given a token and a username or password is refused
rather than letting one silently win. Pass the values after blank-to-unset. The
reason names the fields, never their values.
A token and a username/password are two different logins; which one is meant can't be told, so a client given a token and a username or password is refused rather than letting one silently win. Pass the values after blank-to-unset. The reason names the fields, never their values.