Move authentication to middleware