code: function validateToken(req, reply) {
          var authorization = req.headers.authorization;
          if (!authorization) {
              return reply.continue();
          }
  
          // this is hack fix so that localStorage and cookies can either have Bearer or not
          // if in local storate, it is serialized, so need to replace %20 with space
          // need to fix this in the future at the source (i.e. on the client side)
          authorization = authorization.replace('Bearer%20', 'Bearer ');
          if (!authorization.match(/^Bearer /)) {
              authorization = 'Bearer ' + authorization;
          }
  
          var parts = authorization.split(/\s+/);
  
          if (parts.length !== 2) {
              log.debug('Authorization header invalid: ' + authorization);
              return reply.continue();
          }
  
          if (parts[0].toLowerCase() !== 'bearer') {
              log.debug('Authorization no bearer');
              return reply.continue();
          }
  
          if (parts[1].split('.').length !== 3) {
              log.debug('Authorization bearer value invalid');
              return reply.continue();
          }
  
          var token = parts[1];
          return jwt.verify(token, privateKey)
              .then(function (decodedToken) {
                  return getUserForToken(decodedToken);
              })
              .then(function (user) {
                  req.user = user;
                  return reply.continue();
              })
              // if error continue on as anonymous
              .catch(function () {
                  //log.debug('Problem verifying token: ' + token);
                  return reply.continue();
              });
      }
docs: Attempt to find a user for a given token. There will be an error if the
  Authorization header is invalid, but if it doesn't exist or the user
  can't be found, no error because we let Fakeblock ACLs determine whether
  transaction can be anonymous.
  
  @param req
  @param reply