refactored auth middleware