breaking out middleware from api core