Use token_callback for checking tokens.

Cleans up duplicated code, makes it easier to override token logic, and also fixes an error if datastore.find_user returns None (if token signature is valid but user does not exist).

I added a check for user.is_authenticated() because the token loader could return an AnonymousUser.
I also added an explicit "return False" for consistency.