From a UI perspective, it might be worth putting the SSL bits before the middlewares.