Is `_is_token_auth()` required here? Would it not be sufficient to simply check to see if token_id is true-ish with `if token_id:`?