Watches defined in config file do not use any ACL token

### `consul version` for both Client and Server
Client and Server: `Consul v0.9.2`

### `consul info` for both Client and Server
Client:
```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 75ca2ca
version = 0.9.2
consul:
bootstrap = true
known_datacenters = 1
leader = true
leader_addr = 172.18.0.5:8300
server = true
raft:
applied_index = 36
commit_index = 36
fsm_pending = 0
last_contact = 0
last_log_index = 36
last_log_term = 2
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{Suffrage:Voter ID:172.18.0.5:8300 Address:172.18.0.5:8300}]
latest_configuration_index = 1
num_peers = 0
protocol_version = 2
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Leader
term = 2
runtime:
arch = amd64
cpu_count = 4
goroutines = 75
max_procs = 4
os = linux
version = go1.8.3
serf_lan:
coordinate_resets = 0
encrypted = false
event_queue = 1
event_time = 2
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1
members = 1
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 1
members = 1
query_queue = 0
query_time = 1
```

### Operating system and Environment details
Running consul within the consul:latest (9bf1618f4e63) docker image.
CONSUL_HTTP_TOKEN set to master token.
### Description of the Issue (and unexpected/desired result)
A watch defined within the config (wiht no key explicitly given) will not try to use the CONSUL_HTTP_TOKEN environment variable on startup or consul reload
### Reproduction steps
Consul config:
```
{
"datacenter": "consul-vault-demo",
"data_dir": "/dev/shm",
"log_level": "DEBUG",
"leave_on_terminate": true,
"node_name": "consul-test",
"server": true,
"addresses": {
"http": "0.0.0.0",
"https": "0.0.0.0"
},
"ports" : {
"http":8500,
"https":8501
},
"watches" : [
{
"type":"keyprefix",
"prefix":"watchTriggers/",
"handler":"/Project/WatchScripts/testWatch.sh"
}
],
"bootstrap_expect": 1,
"retry_interval": "15s",
"acl_datacenter":"consul-vault-demo",
"acl_default_policy":"deny",
"acl_down_policy":"deny",
"acl_master_token":"bfa46d59-01f9-4e58-8ab8-3d605b7609bd",
"acl_agent_token":"5727e534-2559-4f2c-b93b-33724fbdfcca"
}
```
Set CONSUL_HTTP_TOKEN to bfa46d59-01f9-4e58-8ab8-3d605b7609bd
Write to watchTriggers/test (watch does not trigger)
Add `"token":"bfa46d59-01f9-4e58-8ab8-3d605b7609bd"` to the watch definition
`consul reload`
Write to watchTriggers/test (watch will trigger)
### Log Fragments
```
2017/09/13 14:09:23 [DEBUG] http: Request PUT /v1/kv/watchTriggers/test (9.816097ms) from=127.0.0.1:40264
2017/09/13 14:09:23 [DEBUG] http: Request GET /v1/kv/watchTriggers/?index=22&recurse= (3.647848915s) from=127.0.0.1:40200
2017/09/13 14:09:23 [DEBUG] http: Request PUT /v1/kv/watchTriggers/test (8.61292ms) from=127.0.0.1:40266
2017/09/13 14:09:23 [DEBUG] http: Request GET /v1/kv/watchTriggers/?index=23&recurse= (714.497213ms) from=127.0.0.1:40200
```