Allow tokenauth authentication to work even when a user is logged in

The difficulty here is that for many use cases (at least, my own and many that I envision), it would be preferred if a token authentication wouldn't override the authenticated session (especially for people who share a computer, or families, etc.).

Maybe it would work better if you use drupal_set_message() to tell the user "The link you used was intended for a different user. Click here to be logged out of your current account and log in as that user for this page." Something like that.

That way, the user would be able to decide whether or not to be logged out.

The concern is that you could click a link in an email, and it would log you in to some other user's view of the page? That is a valid point.

"You have arrived at a special URL that has logged you in as a different user. Click <a>this link</a> to reload the page with your original account."

If we are going to add that, a watchdog() entry to mark this kind of authentication would also be useful as a basic part of this enhancement, facilitating log analysis to detect patterns of a user repeatedly getting ahold of many other people's tokens.

@hefox, thoughts?

Reroll for 6.x-2.x.