refactor middleware
merge auth