remove role checks if no token provided (for fixtures)