Add a enabled-by-default middleware which blocks access to everyone but staffers