refactor auth middleware