updated to use middleware for users