Moved the tenant auth to a listener on kernel.request