be defensive about middleware config