Rate limiter improvements

[n1313]

This PR makes a number of improvements to rate limiter:

1. splits withAuthToken middleware into two: withJWT (which takes JWT string from headers/body/query and parses/validates it) and withAuthToken (which takes parsed JWT and performs DB lookup for user)
2. moves JWT verification function into a separate file so that it could be easily imported and reused in tests
3. places withRateLimiter middleware between withJWT and withAuthToken so that rate limiter checks would be performed after JWT verification but before DB lookup
4. adds rate limiter to admin router