Smarter handling of tokens

In particular, don't get into an infinite loop when a valid token can't be found.

We prefer a user-supplied token if one exists and it's valid; otherwise, fall back to search other locations.

Addresses esap-general#156 (closed)