add middleware to extract authn information from request header