Authorization checks in Next.js middleware can be bypassed