add auth middleware for token expiration and admin status