[Bug] Sending /users/auth to quickly results in wrong token being used

For some weird reason, Firefox seems to send the first /users/auth call twice, both with the old cookies. The result is that the first call will trigger a re-authorization and rotate the token, and the second call will hit the server after the token has been rotated and thus is now unknown. Thus, the server will revoke the cookie and create a new virtual user, effectively logging out the user. This could also be the reason for #24. A proper solution would be to either find the cause of the double-call in Firefox, or keep the outdated tokens around for a while longer to prevent this from happening.