temporary disable server-side auth middleware