Add authorization middleware