simple middleware to control access to protected resources