support token only requests

Don't attempt to authenticate if a token is not available.