Allows chaining through filter, and adds 2 init params

If the allowUnauthorised init param is set to true, allow the request
to pass through the filter, so that it can be validated by a separate
filter.

If the maxSkew init param is set, override the default webauthValidator
maxSkew.