Moved token setup to the authorization middleware