Checks that the request has a valid token with an unexpired challenge timestamp and, if not, returns a browser challenge to the client.