cleanups and return body directly from auth middleware