they changed from username-password to token-based auth and they didn't mark it as a breaking change smh my head