Also did a bit of a cleanup on the auth middleware. There should be no behavioral changes, just moved code around.