Don't try to scan active themes if we don't have a access token

If there's no access token, we don't have a user. If we don't have
a user, we don't know whose themes to look at.