Authentication filter retrieving user from token