authorization handler should should pass the token finder on to the require-user-session middleware
Bump to 1.0.0-rc11

Also bump deps including leiningen to 2.
forgot to pass the token-lookup