tokens: Make sure vps signups check the user token (keep in mind this doesn't include new-user signups, we don't have any way to identify their token as theirs... exploiters may as well just create the users themselves if they wanted to make users through someone.)
Merge pull request #11 from nasonfish/master

tokens: Make sure vps signups check the user token sent with the POST request it receives.