Your auth middleware can attach a user object to environ that your downstream apps could reference.

Whatever else you do (email, onboarding, sqlalchemy) you can do downstream, or directly in the (or a different ) middleware if you want.