Never use the empty string as the default token.

The default token (for unauthenticated users) is `null`, not the empty string.