Token authentication

It should return ```undefined```, not an empty string.