wrap token middleware in a closure