add middleware for authorization