Extract Auth logic into middleware

[harlow]

This change moves Auth into it's own middleware which can be chained with Golang's HandlerFunc. This removes any knowledge of Authentication from the final HTTP Handler code.