Does it matter if the api token is blank?  All we care is if its valid or not? If they send a blank token then it won't be valid.