Fix access token validation

[metalglove]

Currently, the validation for access tokens is mostly done for the services itself.

Requests that require user authentication should be validated.
TODO:

• Wrap messages in auth tokens
• Implements refresh tokens for both services and users
• Upon log out of user invalidate token