BasketService can be inconsistent about whether user is authenticated (or at least can disagree with WebApp)

From @SteveSandersonMS

I'm not sure how to repro this but have seen it twice now. You can have a state where the user is logged in and has a non-expired auth token, so WebApp shows you as being logged in, but:

* Calls to `basketClient.GetBasketAsync` **succeed**
* Calls to `basketClient.UpdateBasketAsync` **fail**, reporting `RpcException: Status(StatusCode="Unauthenticated", Detail="The caller is not authenticated.")`

You can get out of this state by logging out and then back in. But of course we don't want this to occur in the first place.

I suspect the issue is one of two things:

* Either the WebApp and BasketService disagree about the validity of the auth token, and GetBasketAsync simply doesn't enforce auth at all (perhaps it just returns an empty basket if the user isn't authenticated).
* If this is the issue, maybe WebApp is incorrectly configured and isn't validating the auth tokens as strictly as it should be. No idea in what way the config might be wrong though - it was taken from the older MVC app.
* Or, BasketService is internally inconsistent about whether an auth token is valid

Here's what shows up to the user when trying to add an item to the cart in this state: