When logging into the web editor, if an old token is in the cookies, the authentication fails even if user/pass are sent because only the token is checked. If token fails, we should check for the presence of auth headers and if present, try user/pass.