snooping at middleware `next`