tokens: Make sure vps signups check the user token sent with the POST request it receives.

This simply adds on to the previous commit, where tokens are checked to prevent certain exploits. This was not applied to the signup page as easily because it doesn't use the decorator that checked the user token, and it also included new not-logged in users.

It's not as pretty, but it's one of the main issues that needed tokens to fix.

Let me know if I should squash these into one commit, and sorry for missing this in the first PR.