fix: change ..._VERIFY_TOKEN setting to _ENFORCE_ID_TOKEN_VERIFICATION

Change the enforcement setting's semantics. Now the incoming token is
*always* verified but only a warning is printed to the logs unless
API_GATEWAY_AUTH_ENFORCE_IF_TOKEN_VERIFICATION is True.