fix auth middleware