token_required decorator does not work correctly on instance methods

[jkorinth]

The current_user is passed into the decorated function first, switching places with self:

api-server-flask/api/routes.py

Line 76 in 7484320

return f(current_user, *args, **kwargs)

A possible fix would be to retain the first param in the inner decorator function:

def token_required(f):
    @wraps(f)
    def decorator(ref, *args, **kwargs):
         ...
         # call with ref
         return f(ref, current_user, *args, **kwargs)

But this will fail on regular functions. Probably inspect could be used to make it general.