with-auth middleware now works