Allow GET /clusters to not take a token

This is so anyone can get at a public cluster's metadata