Only supply an Authorization header if a token is passed