Allow requests without access_token