Anonymous share links no longer break image uploads

Boot-time token lookups for anonymous share-link viewers could return a 500, causing every uploaded image on the shared app to 404. Non-UUID strings collected from granted rows are now filtered out before being used in the upload lookup query.