api: auth middleware doesn't raise error on invalid token