do not throw when no authorization is provided