use a middleware to take care of authentication
update README