Ensure that token=False works on all requests

This MR fixes #14 (closed) by patching the _prepare_auth helper function to handle this case.