refactor: if the token doesn't match our purpose only error if EmptyAllowed is off

api/middleware/middleware.go

@@ -129,8 +129,10 @@ func AuthMiddleware(options AuthMiddlewareOptions) func(http.Handler) http.Handl
 				aud, _ := claim.GetAudience()
 
 				if options.Purpose != account.JWTPurposeNone && slices.Contains[jwt.ClaimStrings, string](aud, string(options.Purpose)) == false {
+					if !options.EmptyAllowed {
 						return account.ErrJWTInvalid
 					}
+				}
 
 				return nil
 			})