Move the code from autoLogin into GetAuthenticatedUser and allow for
passing in a $token to be used for validating a user so this can be
used for authenticating a user by passing in a valid token (no need to
rely on the token having been stored in a cookie), which will make it
possible to build a REST API that is not reliant on cookies for
authentication.