bind the endpoint to the middleware

- this allows checking this.auth