ensureTokenOrLogin middleware and tests