moved authentication into separate middleware, fixes #27