auth middleware can check both request token or login