only assign Authorization when session exists

oauth3.js

@@ -141,8 +141,10 @@
 
     function lintAndRequest(preq) {
       function goGetHer() {
+        if (preq.session) {
           preq.headers = preq.headers || {};
           preq.headers.Authorization = 'Bearer ' + (preq.session.access_token || preq.session.accessToken);
+        }
 
         if (!oauth3._lintRequest) {
           return rawRequest(preq);