If you provide oauth headers and they incorrect, I want the authentication to fail. This will pass if you don't provide the headers and don't require them. This allows us to turn on oauth, without requiring it and slowly turn on services to use it and make sure they work. So they don't all suddenly fail when REQUIRE_OAUTH is flipped to on.