Validate access token on the server side in custom auth example

There's a `google = require('googleapis')` dependency declared but never used.
It looks like every token received will get a valid session or will be created as a new user, I think there should be a token check against the google api !?

Locate the custom auth example and the declared but unused `google = require('googleapis')` dependency. Trace how received tokens currently create sessions or users, then determine the appropriate Google API token-validation entry point. Done means invalid or unverified tokens cannot create a valid session or new user.

Written by the indexing model from the issue text.