add required option for oauth2 middleware

this addresses situations where authentication is optional. sometimes
you don't want to deny unauthenticated access but allow authentication
when a token is actually provided. in this case the token must still
be valid if it's provided, but if it's not there then the endpoint
will still attempt to handle the request instead of returning a 401.