Move all auth logic to middleware and a service object.