token authentication routes and middleware