ers auth middleware