I agree with @wyllys66. The auth token will still be checked for validity by barbican so whether or not it's present in the returned keystone catalog isn't an issue.