added custom API authentication middleware