Right now all middleware are chained together. The ones that don't receive a config just short-circuit in their `call()`. Ideally only the activated middleware would be applied.