Pass logged in users through in token decorator.

If users have already logged in (with a session cookie for example), this patch
passes them through. This is useful for users who are logged in in a browser
making an AJAX request, or in tests.