return next() if req.apiPass exists in auth()