Don't send 401 if there is no token

It is up to the app to decide what to do when req.user isn't set