fixing security issue: if a user supplied a nonexistent vendor and no token, it was considered valid since both were nil and therefore matched