token middleware fixed