add required option for oauth2 middleware

this addresses situations where authentication is optional. sometimes you don't want to deny unauthenticated access but allow authentication when a token is actually provided. in this case the token must still be valid if it's provided, but if it's not there then the endpoint will still attempt to handle the request instead of returning a 401.