fix(realtime): omit authorization header when no access token exists

[7ttp]

summary

when using the realtime rest fallback without a session, the client sends an empty authorization header which causes a 500 error from the server.

problem

the rest fallback in httpSend() and send()always includes an authorization header, even when no token exists. this results in Authorization: (empty value) being sent, which the server rejects with 500.

fix

only add the authorization header when AccessTokenValue is truthy. the server accepts requests with just the apikey header.

closes #1936 & #1590
supersedes #1561

cc @mandarini