factored out login middleware