Replace Auth middleware with hook

This is needed for CORS headers to apply to authentication errors too. Hook is handled after the middleware so request may never reach it.