The "&& !isMandatory(requestContext)" part is really not needed here, it's possible for the SAM to set a Success/Unauthenticated  response even for a protected resource. I'll update the PR.