Move OCS Middleware before security middleware

This is required to be able to catch the NotLoggedIn exceptions etc in
the OCSMiddleware and convert them to proper OCS Responses.