add middleware to validate token expiration and admin status