only send auth token if it is present

This allows GetSessionID requests without an auth_token