Cookie synchronisation happens even in token mode

[rmccue]

If you pass an access token to the API, the Cookie\attempt_authentication() handler will kick in and attempt to synchronise the user from the source. It will use the token from user meta, rather than the one passed in the request.

This should only kick in if cookie auth is used, not in all cases.

Additionally, if the stored token has been revoked, this will lead to 500 errors.

[joehoyle]

Also ran into this... it leads to nasty bugs when you have oauth tokens stored against users in the DB that are no longer valid.