invalidate when vendor is passed in as nil. Otherwise, if an api call would be authorized no matter what if no vendor and token are specified, because they'd match since they're both nil!