add middleware to validate token expiration and admin status

I like the idea of having a second middleware but you probably want to reject an expirted JWT before makign a request to the database.