Express Middleware for ability checking