This is completely correct yes. It’s due to how the middlewares are loaded and this cache runs before the auth.