Always emit 'auth-done', but set decoded_token only on successful auth