middlwear authentication for API