moved service plugin out. new middleware auth