split auth.has and .hasMiddleware