insert auth middleware; fix findOne
auth flow ok
user/pass auth ok
token auth ok