using a single middleware that can be turned off