Fix wheel token auth by moving eauth checks below token

Simpler (safer) fix.