Don't skip past login.html page with invalid token

[nobbyknox]

We only check for the existence of an authentication cookie and wave the visitor past when she can produce it. The token should be checked for validity before the visitor is waved past.

[nobbyknox]

Done