authentication middleware triggered on api