add token middleware