Access control middleware