Fix auth: wrong middleware order