wsapi.js: if the DB doesn't have a token, don't enforce equality

This honors the preceding comment about not gratuitously expiring
innocent sessions. Somehow this clause got lost as I was
merging/rebasing this function.