Using both Basic auth and Session auth in get uri request

With the way I interpret that wording, I don't see a client providing a Basic Authentication header when performing a POST to /redfish/v1/SessionService/Sessions as a bad request; it's certainly not useful, but I don't see a need to reject the request. Rather, the intent of that line is to ensure a service does not reject the request in the absence of the Basic Authentication header.

I think there is certainly room for clarity though. As you've also pointed out, we don't discuss what happens when the client provides both the Basic Authentication header and the session token header. My personal preference would be to avoid assigning a priority though, since if we add additional authentication methods, that can become difficult to manage. We will need to discuss this more and update the specification.