protected routes with middleware, added profile page, made a super sweet token verification