Move auth functionality to separate middleware