See `middleware.authenticationhandler`