Express-api bearer-token middleware (client credentials grant)