Move token authentication to lib directory to keep route_bindings as
simply a list of routes