moved auth to express middleware