Do not attempt to generate URLToken for anonymous downloads (#5078)

This is a regression since last release - fixes #5076

cmd/jwt.go

@@ -93,6 +93,9 @@ func keyFuncCallback(jwtToken *jwtgo.Token) (interface{}, error) {
 }
 
 func isAuthTokenValid(tokenString string) bool {
+	if tokenString == "" {
+		return false
+	}
 	var claims jwtgo.StandardClaims
 	jwtToken, err := jwtgo.ParseWithClaims(tokenString, &claims, keyFuncCallback)
 	if err != nil {