update for auth in middleware