better default for auth_middleware