refact(server): move protectJSON middleware into its own file