I'm not sure what this solves atm, we still store username and password in the session and the credentials are used to access the api, this now just creates a separate access token?

So perhaps we can detect then if we already have the token?
I think it's just important to make clear what we're using in which cases, atm. it seems a bit unclear when looking at the code (looking at this diff, I wouldn't expect that api requests still work after reverting the changes here).
Maybe it just requires a comment or two.

Actually I was wrong. We're not using access token here, we're using the one-time password. And we can't use it as an API token, so we have to call api/auth/login. I added a comment, and enabled fast mode as a performance improvement.