Split authentication and authorization, updated middleware stack