Extend the check_api_acls method to support using a token for authentication only
    
    This way if someone specifies a token, we can authenticate them but if
    for GET request that do not require ACLs to access, we can authenticate
    without checking for authorization.