[WIP] Token identification

First cut at this, any thoughts?
Rather than guard here, be more assertive and handle this in `#sign_in`.