allow override of the token decorator

This seems like the simplest way to allow clauth users to implement OpenID connect.