feature(client): Validating sessionToken on views that mustAuth.

Views with `mustAuth` enabled now validate the `sessionToken` on every request. It happens asynchronously so there's no negative performance impact on the user. There is the potential for an undesirable flash of the protected content if the `sessionToken` is invalid, but considering that this should be an exceptional case, I don't think we should be overly concerned.

Fixes #743.