Should add here that authenticated user takes precedence over token.
If there is a logged-in user, it's her objects that are available.