Adds a new PlHook subclass for token-authenticated requests.

Adds a new PlHook subclass for token-authenticated requests.

The new hook checks for either a valid token (in which case the
authentication level is assumed to always match), or a valid session (in
which case the auth level is checked against the session). Note that
this finally allows token-based handlers to be permission checked.

Signed-off-by: Vincent Zanotti <vincent.zanotti@m4x.org>