use http_middleware to start user session based on token.