moving api user check logic out of apiAuthJwt
change auth middleware to be enclosed in extra closure