Move security middleware earlier in setup lifecycle so that it will apply to app routes