not using Bearer Auth if not access token supplied