NOTE: removed AppUserMixin. Instead, use middleware