start of the auth middleware