Evaluate JWT at the correct time

[nsheff]

This issue is a spinoff of #377.

Right now, we're evaluating the JWT (including checking for an expired token) even for public requests. This is because we evaluate the JWT if it's given, in the dependencies.

Instead, we should restructure this to do the JWT validation only if something private was requested. So whether we evaluate the JWT shouldn't be modulated at the level of endpoints; it should instead be at the level of privacy-vs-not.