fixing auth middleware to use token instead of session