it's got me thinking, is this the best way to add a middleware that we want only the API to use? you and @andymckay can debate that, but I'm curious.