API token check true when no token is set/given

For restricting some database actions we use a secret token. This token is set via env vars usually in a file named ahikar.env. Currently the test for the token is true when no token is given and no token is set. To make the app more fail-safe we have to ensure either a token is set or a token is given.