Middlewares

This PR proposes an approach to wrapping middlewares that's consistent across `search` and `http`. As an example of one such search middleware, I've sketcehed out `searchByPatient`, which can automatically restrict search results based on the currently-configured in-context patient. I also refactored the `authentication` middleware to use this approach

Thoughts?