[identity] verify user access token

Summary:
basically copied the old RPC implementation

Depends on D7553

Test Plan: called the RPC with bloomRPC with an existing valid token, existing invalid token, and nonexistent token

Reviewers: jon, bartek

Reviewed By: jon

Subscribers: ashoat, tomek, atul

Differential Revision: https://phab.comm.dev/D7594