Agreed, that is a better scenario. Then again, stuff like authentication and authorization (two separate concepts!) are often better handled on some middleware

Agreed, that is a better scenario. Then again, stuff like authentication and authorization (two separate concepts!) are often better handled on some middleware or service layer than in models and controllers.