Refactored authentication into middleware. Added explicit authorization checks.