Optional authorization

For middleware that should continue without a user if no valid
authorization is present.