token auth for user info route