secret or auth middleware for all endpoints