fix bug; now checking for jwt using middleware