extract ensureauthenticted to middleware