Updated API for delegation token

It will never get here due to the previous if :). For this case, I'd always require them to be sent and not use the User's one.