fix auth middleware to deal with tokens instead of cookies