Just playing devil's advocate here, but is there something else we could do so that we don't have a hard coded list of exceptions? Something like either not registering the auth middleware at all for these exceptions? Or possibly some way to uniquely identify each route that actually requires authentication, possibly by changing route names or adding a flag of some sort?