next js middleware security issue