scanner: issue a warning when no auth token exists
This should make the problem more obvious to new users.