That token should not be considered optional. Even if you require authentication you should still have a one time expiring token tied to an actual form recently

That token should not be considered optional. Even if you require authentication you should still have a one time expiring token tied to an actual form recently shown on your site for this sort of thing, Or an api key if it's a rest service. Your "if possible" clause makes it seem optional but if you don't include it then your service is vulnerable, period.