Removed _is_token_auth()

If request contains token id it is assumed to be token auth.