Respect subdirectory in authenticate middleware