server: fix api middleware path