it might be worth putting this in its own module and `require`ing that, but keeping it in the generic middleware.js is also fine. Benefit of being in its own module would be that you can do `credentialsLookupStrategy = require( "strategy" )( env.get( "USE_DEV_KEY_LOOKUP" ) );` and keep all the strategy switching in one place.