middleware checks for a request bearer token, ensures there is only one authentication method, and sets the token property on the request for convenience downstream.