support token without user_id (for clients authenticating directly)

Previously token without a user_id would blow up trying, to create an admin user in #create_admin_if_in_token.