We were looking only for users in throttle_unauthenticated requests.

Now we try to find also a runner with the provieded token if the
request is for the API.