added access control for access_token
Excluded user-login routes from all the access_token required routes
Updated error message when access_token is invalid
updated error_message