Use token_callback for checking tokens.

This also fixes an error if datastore.find_user returns None (if token is valid but user does not exist).

I added a check for user.is_authenticated() because the token loader could return an AnonymousUser.
I also added an explicit "return False" for consistency.