Remove the db query in auth.

[DutChen18]

Probably using some token refreshing scheme, and/or keeping a cache of valid tokens in memory.

[BoySanic]

This has further issues than just disabled_at.

For instance, permissions. How do we check permissions during auth for a particular endpoint?
I think it does need to be rewritten at some point. I'm just not sure how we avoid querying the db for stuff that I would imagine belongs in the db.