add policy to check token and assign req.user