api: move middleware up before app.router