update middleware to only use session/authentication middleware for admin