Token authentication doesn't perform authorization

The token authentication skips the authorization step which causes all users that use token authentication (i.e. the GUI) to behave as if they had write access.