Only add auth header if there is an access token set.
Add basic OAuth helper tests (ensure path + no scope).