move token parser from access_token to token middleware