Missing permission check when token cache and pre/post filter

Overview:
In an env where pre/post filter module is enabled (mod-aes for example), accessing API without permission is allowed.

Steps to Reproduce:

1. Set up an env with pre/post filter module enabled (mod-aes-0.0.4 for example)
2. Create a user with limited permissions and get x-okapi-token
3. Use above token to access APIs that requires other permissions
4. The first try will be denied with 403, but following tries will success

Expected Results:
API is protected by permissions

Actual Results:
API permission protection is void

Additional Information:
Disable token cache by setting token_cache_max_size to 0, or disable the pre/post filter module can prevent this security issue.

Interested parties:
adam, jakub, cmcnally, mreno