Looking at the code, fedora-create-review seems to fall back to username / password authentication by default if no config file with an API key is present. This authentication method is going away in a few weeks, and any attempts to use it will invalidate credentials.

• The login_bz() method should probably be removed entirely to avoid having users input credentials just to have them invalidated.
• fedora-create-review should probably require the bugzilla config file with an API to be present, or provide instructions for the user how to get an API key and set up that file.