authentication events and middleware