fixup! add another test

it('does not include loopback.token when auth not enabled')