Factor out MFA-passcode-checking into middleware