improved the auth middleware by removing the assumptions it makes over whats in the cookie; pass a hash, that hash will be decrypted and handed to the consumer.  also introduced an onReceive hook to allow custo handling of the decrypted token hash