refactoring authorization middleware