diff --git a/web/includes/auth.php b/web/includes/auth.php
index 3a168794c..bbce5e61e 100644
--- a/web/includes/auth.php
+++ b/web/includes/auth.php
@@ -565,7 +565,15 @@ if (ZM_OPT_USE_AUTH) {
     // don't know the token type. That will
     // be checked later 
     $ret = validateToken($_REQUEST['token'], 'any');
-    $user = $ret[0];
+    if (!$ret[0]) {
+      // validateToken returns array(false, $errorMessage) on failure.
+      // Assigning false to $user would leave isset($user) true, bypassing
+      // the ZM_OPT_USE_AUTH gate in index.php. Unset so $user stays undefined.
+      ZM\Warning($ret[1]);
+      unset($user); // unset should be ok here because we aren't in a function
+    } else {
+      $user = $ret[0];
+    }
   } else {
     // Non token based auth - session required for $_SESSION access
     if (!is_session_started()) {