general verifyAccessToken middleware; use at token verification endpoint