add a middleware for only allowing requests from cloudfront