Handle token observe better with overlapping login

Before this, we could see the "non-null user observe" error if:

- One login method ran (eg login) and it called _setLoginToken.
  It stored null in userObservesForConnections and gets to the
  defer/observe part
- Another login method ran (eg getNewToken) and it called
  _setLoginToken. The call to removeTokenFromConnection at the top
  clears the null from userObservesForConnections, and it then
  stores its own null in userObservesForConnections, and defers
- One of them finishes the observe and puts its observe in
  userObservesForConnections, overwriting the null which it thinks
  is its alone
- The other one gets there and throws

Also, consistently use _.has when checking if userObservesForConnections
has an element.