Its middleware reads the user (auth or session) and the cache, so those
features' middleware must run first whatever the registration order.
None is required: without them every request is anonymous.
Drops the cached permissions and roles of userId, so the next request
loads them again. Call it after changing them (a role revoked, a user
blocked): until then the cached copy applies, for up to cacheTTL.
Its middleware reads the user (auth or session) and the cache, so those features' middleware must run first whatever the registration order. None is required: without them every request is anonymous.