> they are both a username and a password as a single entity
And should your username ever also be your password?
It shouldn't be, but it shouldn't be disallowed.
Sometimes it is fine, depending on the particular application. I often use a single token to identify myself to office buildings, my car, my house, etc. Even my bank is okay with it, although that is more debatable.