Move middleware to auth