default to simplified authentication by token (making HMAC optional)