export default (config) => {
	if ( ! config.enabled) return (req, res, next) => { next() }

	var header = (config.header || 'Authorization').toLowerCase()
	var tokenLength = 32
	var tokenRegExp = new RegExp(`^Token ([a-zA-Z0-9]{${tokenLength}})$`)

	return (req, res, next) => {
		var value = req.headers[header]
		var err
		req.auth = { header: value }

		if ( ! req.auth.header) {
			err = new Error(`Missing ${config.header} header.`)
			err.statusCode = 401
			return next(err)
		}

		if (config.byToken) {
			var token = value.replace(tokenRegExp, '$1')

			if (token.length !== tokenLength) {
				err = new Error('Invalid token.')
				err.statusCode = 401
				return next(err)
			}

			req.auth.token = token
		}

		if ( ! config.method) return next()

		config.method(req, config, req.data, (err, user) => {
			if (err) {
				err = new Error(err)
				err.statusCode = 401
				return next(err)
			}

			req.user = user
			next()
		})
	}
}

@@ -85,16 +85,56 @@
 xt() %7D%0A%0A
+%09var verifyHeader = ( !! config.header)%0A
 %09var hea
@@ -162,21 +162,8 @@
 %7C%7C '
-Authorization
 ').t
@@ -309,78 +309,107 @@
 var 
-value = req.headers%5Bh
+err%0A%0A%09%09req.auth = %7B%7D%0A%0A%09%09if (verifyH
 eader
-%5D
+) %7B
 %0A%09%09
+%09
 var 
-err%0A%09%09req.auth = %7B header: value %7D
+value = req.auth.header = req.headers%5Bheader%5D
 %0A%0A
+%09
 %09%09if
@@ -417,27 +417,18 @@
 ( ! 
-req.auth.header
+value
 ) %7B%0A
+%09
 %09%09%09e
@@ -481,16 +481,17 @@
 r.%60)%0A%09%09%09
+%09
 err.stat
@@ -503,16 +503,17 @@
 e = 401%0A
+%09
 %09%09%09retur
@@ -526,19 +526,21 @@
 (err)%0A%09%09
+%09
 %7D%0A%0A
+%09
 %09%09if (co
@@ -551,24 +551,25 @@
 .byToken) %7B%0A
+%09
 %09%09%09var token
@@ -605,16 +605,17 @@
  '$1')%0A%0A
+%09
 %09%09%09if (t
@@ -641,32 +641,33 @@
 enLength) %7B%0A%09%09%09%09
+%09
 err = new Error(
@@ -684,24 +684,25 @@
 oken.')%0A%09%09%09%09
+%09
 err.statusCo
@@ -702,32 +702,33 @@
 tatusCode = 401%0A
+%09
 %09%09%09%09return next(
@@ -731,27 +731,29 @@
 ext(err)%0A%09%09%09
+%09
 %7D%0A%0A
+%09
 %09%09%09req.auth.
@@ -766,16 +766,21 @@
 = token%0A
+%09%09%09%7D%0A
 %09%09%7D%0A%0A%09%09i

Make request header optional in authentication middleware.