diff --git a/include/token_authorization_middleware.hpp b/include/token_authorization_middleware.hpp
index 61c8385..1602656 100644
--- a/include/token_authorization_middleware.hpp
+++ b/include/token_authorization_middleware.hpp
@@ -4,7 +4,15 @@
 #include <crow/http_response.h>
 
 namespace crow {
+
+struct User {
+
+};
+
 struct TokenAuthorizationMiddleware {
+  // TODO(ed) auth_token shouldn't really be passed to the context
+  // it opens the possibility of exposure by and endpoint.
+  // instead we should only pass some kind of "user" struct
   struct context {
     std::string auth_token;
   };