replace verifyUserToken middleware with verifyAccessToken; deprecate verifyUserToken