Application password header not checked in REST API

Question

I have this code in my custom plugin. I've created an application password and I want to check it every time a custom endpoint is called.

        register_rest_route( 
            $this->namespace, 
            '/activation-check', 
            array(
                'methods' => 'GET',
                'callback' => array($this, 'send_activation_emails'),
                'permissions_callback' => function( WP_REST_Request $request ){
                    $application_password = $request->get_header('Authorization');
                    if(empty($application_password)){
                        return new WP_Error(
                            'Forbidden',
                            __('Forbidden'),
                            array(
                                'status' => 403
                            )
                        );
                    } else {
                        //
                        $user = wp_check_application_passwords($application_password);
                        //
                        if(is_wp_error($user)){
                            return new WP_Error(
                                'Forbidden',
                                __('Invalid application password'),
                                array(
                                    'status' => 403
                                )
                            );
                        } else {
                            return true;
                        }
                    }

                }
            ) 
        );

I've noticed that the endpoint will use the callback also if no authorization header is sent with the ajax requests. Is there something I can do prevent that the endpoint can give sensistive data if the application password isn't provided?