For all authenticated requests ensure a token check is done

[atruskie]

The cookie is hard to kill. We need to live with it.

However, we need to ensure our rest API also work properly.

So if a cookie and an auth_token are sent in a single request, we need to ensure the auth_token is always checked (not just skipped if the session-cookie authenticates first) .

Also ensure this behavior is working for images off the media controller.