Don't add Authorization header when credential not present