authenticate checks to ensure the access token has not expired and it has a user (signed in)