how to secure api from trpc middleware? didn't find docs