Separate param-check middleware of auth middleware
Move user creation to /app/init