auth middleware should set token instead of user so no infomation is lost
api throttle