protected user info endpoint; corrected access token verification