Actually use the groupfinder in the token auth

This code broke when I was changing things quickly. Thankfully, it
never shipped to production or a release tag, because it basically
meant that tokens were trusted. The mistake was in the argument
passing when the policy was instantiated, which resulted in a null
groupfinder callback.

Clean this up by not overriding the constructor in the policy, but
just constructing it appropriately in the includeme code. This will
make it easier to customize anyway.