use default token strategy if auth header is missing