middleware can reject the promise via next.reject()