Allows chaning through filter, and adds 2 init params

If the  allowUnauthorised init param is set to true, allow the request
to pass through the filter, so that it can be validated by a seperate
API filter.

If the maxSkew init param is set, override the default webauthValidator
maxSkew.