Why no 401 if token is null empty or whitespace. See comment on AuthorizationOptional for example.