Moved authorisation middleware before message store middleware

Closes #93
Maybe it'd be better to set this up as an ObjectId rather than a string? I'm sure it's not really a big deal, but you never know.