auth: use an .env file if api token doesn't exist in env

[jafow]

auth token should be able to live in an .env file if not in the environment.