don't 500 if there's no X-Auth-Token header