Our middleware must run after auth.