Its possible to get into a state where you are logged in and do not have a token

Through some re-opening of chrome I was put into a state of not having a token, but viewing /play. This shouldn't be possible.

[edbrown23]

Reasonably simple fix I believe. The view which serves /play/ in domoweb/interface can be made much smarter, to check for a token for the user who django says is logged in, and redirect to the login page accordingly. Some step could also be added to give them immediate access to /play/ to users who have session cookies, but no tokens, but that is an enhancement.