When we pass in the middleware we have the collection name but not the projection name, to correctly setup authorizations we need to pass this information all along