Consolidate sale ID checking

[ashfurrow]

Raised by @acjay in this comment, the jwt query should fetch the _id of a sale upfront to avoid spreading the "check id and also _id" logic throughout the codebase.