Add token protection to workout endpoints