Add missing token middleware

/to @bajtos 
/cc @raymondfeng 

I manually tested this. My attempt at adding smokescreen tests around user auth failed. I'd like to address that in another PR.

**Note:** this should be released as soon as possible as `v2.1.3`.

/related https://github.com/strongloop/loopback/issues/117#issuecomment-31399675