Validate access token on the session user

We had been short-circuiting token validation if there was already a locally authenticated user in warden. Now, with every API request, g5_authenticatable_api will retrieve the access token from the session user (if they exist) and validate it against the auth server.