remove test middleware
checks session token so one can only GET logged in user's info