Split of authenticate()

into acceptToken() and restricted()