add attr middleware and fix load/auth chain