We should consider an invalid (expired...) token as an expired session and thus error out if someone tries to access an API endpoint with it, this even if the API endpoint would work w/o any token (which is the case for the optional_token endpoints)
Fixed in https://pagure.io/pagure/pull-request/185
And Merged :)