If an auth token is obtained for some other purpose than user account login, it would be ignored an replaced with another when an actual login attempt is made, wasting the previously obtained one. Caching avoids that potential waste, but must be manually cleared client-side when the login completes due to the remote side has consuming it.