Extend validation in subApp to any kind

SSL or non-SSL
Missing file with new auth middleware
Adapt validation to require SSL clients only