Ensure object/ds are accessible before verifying token. (#701)

islandora.module

@@ -881,7 +881,10 @@ function islandora_object_access_callback($perm, $object = NULL) {
 function islandora_object_datastream_tokened_access_callback($perm, $object = NULL, $datastream = NULL) {
   module_load_include('inc', 'islandora', 'includes/utilities');
 
+  // Token validation requires a valid object and PID in order to make a
+  // potential match in the db.
   $token_account = NULL;
+  if (is_object($object) && is_object($datastream)) {
     $token = filter_input(INPUT_GET, 'token', FILTER_SANITIZE_STRING);
 
     if ($token) {
@@ -890,6 +893,7 @@ function islandora_object_datastream_tokened_access_callback($perm, $object = NU
         $token_account = user_load($user->uid);
       }
     }
+  }
 
   return islandora_datastream_access($perm, $datastream, $token_account);
 }