handle invalid tokens:

- about half of the functions that require auth in order to actually
  produce results wasn't even paying attention to whether the token
  was valid or not. This is no longer the case. Whew!

Signed-off-by: William Rockwood <wrockwood@tadl.org>