This matches the behaviour of heat-cfn.
One day Heat will support doing all operations with only a token. Today is not that day.
Also add a --token-only option to suppress sending username/password.
Change-Id: Ib439d770e90d381ffc83babf7fca85c9f1e32e64