updated so auth is only included in call if a token is present, also cleaned up tests