If you were registered there on 1.x, the user and password logs may have not been deleted at the server. Therefore you still have to type /identify password to login. I know it's like that on gamesunited, but I havn't tried hepcat.
The hepcat server has the /identify disabled, and every time I have checked the only users playing that the server shows as logged in are using the win32 version, I can only assume the linux and other users are getting the same bad token message as me?
check and see if your isp is using a caching proxy server. if it is, you want to change your list server URL in your config to http://my.bzflag.org:81/db/
You use Hoplite as your callsign, and type your password for your account into the password field in BZFlag. If the server is configured right (which most are), you will have the plus sign.
JeffM