add user auth, admin auth, password verification and token expiration date

awesome, great call on failing an expired token before making the db request.