Fix issue verifying auth tokens

Just like the authenticator we set up for the store, our hybrid
authentication policy needs to leverage the consumer lookup to
get a secret used to verify the tokens.