Fix a race condition in the authorization middleware

This should fix #196.