api: properly handle user token in the authTokenMiddleware

Now this middleware validates the user token, and check whether the app
exists and the user has access to it.