diff --git a/backend/handler/email_test.go b/backend/handler/email_test.go
index bce6ef061a..9458802b45 100644
--- a/backend/handler/email_test.go
+++ b/backend/handler/email_test.go
@@ -39,7 +39,7 @@ func (s *emailSuite) TestEmailHandler_List() {
 	err := s.LoadFixtures("../test/fixtures/email")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	s.Require().NoError(err)
@@ -172,7 +172,7 @@ func (s *emailSuite) TestEmailHandler_Create() {
 			cfg.AuditLog.Storage.Enabled = true
 			cfg.Emails.RequireVerification = currentTest.requiresVerification
 			cfg.Emails.MaxNumOfAddresses = currentTest.maxNumberOfAddresses
-			e := NewPublicRouter(&cfg, s.Storage, nil)
+			e := NewPublicRouter(&cfg, s.Storage, nil, nil)
 			jwkManager, err := jwk.NewDefaultManager(cfg.Secrets.Keys, s.Storage.GetJwkPersister())
 			s.Require().NoError(err)
 			sessionManager, err := session.NewManager(jwkManager, cfg)
@@ -234,7 +234,7 @@ func (s *emailSuite) TestEmailHandler_SetPrimaryEmail() {
 	err := s.LoadFixtures("../test/fixtures/email")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	s.Require().NoError(err)
@@ -278,7 +278,7 @@ func (s *emailSuite) TestEmailHandler_Delete() {
 	err := s.LoadFixtures("../test/fixtures/email")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 	userId := uuid.FromStringOrNil("b5dd5267-b462-48be-b70d-bcd6f1bbe7a5")
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
diff --git a/backend/handler/passcode_test.go b/backend/handler/passcode_test.go
index 8e3189b76b..523b964051 100644
--- a/backend/handler/passcode_test.go
+++ b/backend/handler/passcode_test.go
@@ -43,7 +43,7 @@ func (s *passcodeSuite) TestPasscodeHandler_Init() {
 		return cfg
 	}
 
-	e := NewPublicRouter(cfg(), s.Storage, nil)
+	e := NewPublicRouter(cfg(), s.Storage, nil, nil)
 
 	emailId := "51b7c175-ceb6-45ba-aae6-0092221c1b84"
 	unknownEmailId := "83618f24-2db8-4ea2-b370-ac8335f782d8"
@@ -278,7 +278,7 @@ func (s *passcodeSuite) TestPasscodeHandler_Finish() {
 			sessionManager, err := session.NewManager(jwkManager, test.DefaultConfig)
 			s.Require().NoError(err)
 
-			e := NewPublicRouter(currentTest.cfg(), s.Storage, nil)
+			e := NewPublicRouter(currentTest.cfg(), s.Storage, nil, nil)
 
 			// Setup passcode
 			err = s.Storage.GetPasscodePersister().Create(currentTest.passcode)
diff --git a/backend/handler/password_test.go b/backend/handler/password_test.go
index 0d8363ce58..110ee7fa72 100644
--- a/backend/handler/password_test.go
+++ b/backend/handler/password_test.go
@@ -101,7 +101,7 @@ func (s *passwordSuite) TestPasswordHandler_Set_Create() {
 			req.AddCookie(cookie)
 			rec := httptest.NewRecorder()
 
-			e := NewPublicRouter(cfg, s.Storage, nil)
+			e := NewPublicRouter(cfg, s.Storage, nil, nil)
 			e.ServeHTTP(rec, req)
 
 			s.Equal(currentTest.expectedCode, rec.Code)
@@ -171,7 +171,7 @@ func (s *passwordSuite) TestPasswordHandler_Login() {
 			req.Header.Set("Content-Type", "application/json")
 			rec := httptest.NewRecorder()
 
-			e := NewPublicRouter(currentTest.cfg(), s.Storage, nil)
+			e := NewPublicRouter(currentTest.cfg(), s.Storage, nil, nil)
 			e.ServeHTTP(rec, req)
 
 			if s.Equal(currentTest.expectedCode, rec.Code) {
diff --git a/backend/handler/token_test.go b/backend/handler/token_test.go
index 5617915e37..92d494a5ce 100644
--- a/backend/handler/token_test.go
+++ b/backend/handler/token_test.go
@@ -48,7 +48,7 @@ func (s *tokenSuite) TestToken_Validate_TokenInCookie() {
 
 	cfg := s.setupConfig()
 	cfg.Session.EnableAuthTokenHeader = false
-	e := NewPublicRouter(cfg, s.Storage, nil)
+	e := NewPublicRouter(cfg, s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusOK)
@@ -94,7 +94,7 @@ func (s *tokenSuite) TestToken_Validate_TokenInHeader() {
 	rec := httptest.NewRecorder()
 
 	cfg := s.setupConfig()
-	e := NewPublicRouter(cfg, s.Storage, nil)
+	e := NewPublicRouter(cfg, s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusOK)
@@ -127,7 +127,7 @@ func (s *tokenSuite) TestToken_Validate_ExpiredToken() {
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 
-	e := NewPublicRouter(s.setupConfig(), s.Storage, nil)
+	e := NewPublicRouter(s.setupConfig(), s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusUnprocessableEntity)
@@ -150,7 +150,7 @@ func (s *tokenSuite) TestToken_Validate_MissingTokenFromRequest() {
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 
-	e := NewPublicRouter(s.setupConfig(), s.Storage, nil)
+	e := NewPublicRouter(s.setupConfig(), s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusBadRequest)
@@ -173,7 +173,7 @@ func (s *tokenSuite) TestToken_Validate_InvalidJson() {
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 
-	e := NewPublicRouter(s.setupConfig(), s.Storage, nil)
+	e := NewPublicRouter(s.setupConfig(), s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusBadRequest)
@@ -201,7 +201,7 @@ func (s *tokenSuite) TestToken_Validate_TokenNotFound() {
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 
-	e := NewPublicRouter(s.setupConfig(), s.Storage, nil)
+	e := NewPublicRouter(s.setupConfig(), s.Storage, nil, nil)
 	e.ServeHTTP(rec, req)
 
 	s.Equal(rec.Code, http.StatusNotFound)
diff --git a/backend/handler/user_test.go b/backend/handler/user_test.go
index 4f7b143b8d..d24e2b7937 100644
--- a/backend/handler/user_test.go
+++ b/backend/handler/user_test.go
@@ -33,7 +33,7 @@ func (s *userSuite) TestUserHandler_Create_TokenInCookie() {
 	}
 
 	cfg := test.DefaultConfig
-	e := NewPublicRouter(&cfg, s.Storage, nil)
+	e := NewPublicRouter(&cfg, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "jane.doe@example.com"}
 	bodyJson, err := json.Marshal(body)
@@ -78,7 +78,7 @@ func (s *userSuite) TestUserHandler_Create_TokenInHeader() {
 
 	cfg := test.DefaultConfig
 	cfg.Session.EnableAuthTokenHeader = true
-	e := NewPublicRouter(&cfg, s.Storage, nil)
+	e := NewPublicRouter(&cfg, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "jane.doe@example.com"}
 	bodyJson, err := json.Marshal(body)
@@ -118,7 +118,7 @@ func (s *userSuite) TestUserHandler_Create_CaseInsensitive() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "JANE.DOE@EXAMPLE.COM"}
 	bodyJson, err := json.Marshal(body)
@@ -153,7 +153,7 @@ func (s *userSuite) TestUserHandler_Create_UserExists() {
 	err := s.LoadFixtures("../test/fixtures/user")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "john.doe@example.com"}
 	bodyJson, err := json.Marshal(body)
@@ -175,7 +175,7 @@ func (s *userSuite) TestUserHandler_Create_UserExists_CaseInsensitive() {
 	err := s.LoadFixtures("../test/fixtures/user")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "JOHN.DOE@EXAMPLE.COM"}
 	bodyJson, err := json.Marshal(body)
@@ -194,7 +194,7 @@ func (s *userSuite) TestUserHandler_Create_InvalidEmail() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/users", strings.NewReader(`{"email": 123"}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -209,7 +209,7 @@ func (s *userSuite) TestUserHandler_Create_EmailMissing() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/users", strings.NewReader(`{"bogus": 123}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -226,7 +226,7 @@ func (s *userSuite) TestUserHandler_Create_AccountCreationDisabled() {
 	}
 	testConfig := test.DefaultConfig
 	testConfig.Account.AllowSignup = false
-	e := NewPublicRouter(&testConfig, s.Storage, nil)
+	e := NewPublicRouter(&testConfig, s.Storage, nil, nil)
 
 	body := UserCreateBody{Email: "jane.doe@example.com"}
 	bodyJson, err := json.Marshal(body)
@@ -250,7 +250,7 @@ func (s *userSuite) TestUserHandler_Get() {
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	if err != nil {
@@ -290,7 +290,7 @@ func (s *userSuite) TestUserHandler_GetUserWithWebAuthnCredential() {
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	if err != nil {
@@ -325,7 +325,7 @@ func (s *userSuite) TestUserHandler_Get_InvalidUserId() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
@@ -356,7 +356,7 @@ func (s *userSuite) TestUserHandler_GetUserIdByEmail_InvalidEmail() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/user", strings.NewReader(`{"email": "123"}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -371,7 +371,7 @@ func (s *userSuite) TestUserHandler_GetUserIdByEmail_InvalidJson() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/user", strings.NewReader(`"email": "123}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -386,7 +386,7 @@ func (s *userSuite) TestUserHandler_GetUserIdByEmail_UserNotFound() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode.")
 	}
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/user", strings.NewReader(`{"email": "unknownAddress@example.com"}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -406,7 +406,7 @@ func (s *userSuite) TestUserHandler_GetUserIdByEmail() {
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/user", strings.NewReader(`{"email": "john.doe@example.com"}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -435,7 +435,7 @@ func (s *userSuite) TestUserHandler_GetUserIdByEmail_CaseInsensitive() {
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodPost, "/user", strings.NewReader(`{"email": "JOHN.DOE@EXAMPLE.COM"}`))
 	req.Header.Set("Content-Type", "application/json")
@@ -464,7 +464,7 @@ func (s *userSuite) TestUserHandler_Me() {
 
 	userId := "b5dd5267-b462-48be-b70d-bcd6f1bbe7a5"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	if err != nil {
@@ -501,7 +501,7 @@ func (s *userSuite) TestUserHandler_Logout() {
 		s.T().Skip("skipping test in short mode.")
 	}
 	userId, _ := uuid.NewV4()
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	if err != nil {
@@ -542,7 +542,7 @@ func (s *userSuite) TestUserHandler_Delete() {
 	userId, _ := uuid.FromString("b5dd5267-b462-48be-b70d-bcd6f1bbe7a5")
 	cfg := test.DefaultConfig
 	cfg.Account.AllowDeletion = true
-	e := NewPublicRouter(&cfg, s.Storage, nil)
+	e := NewPublicRouter(&cfg, s.Storage, nil, nil)
 
 	jwkManager, err := jwk.NewDefaultManager(test.DefaultConfig.Secrets.Keys, s.Storage.GetJwkPersister())
 	if err != nil {
diff --git a/backend/handler/webauthn_test.go b/backend/handler/webauthn_test.go
index df05c04a7e..f0a7757ef0 100644
--- a/backend/handler/webauthn_test.go
+++ b/backend/handler/webauthn_test.go
@@ -33,7 +33,7 @@ func (s *webauthnSuite) TestWebauthnHandler_NewHandler() {
 	if testing.Short() {
 		s.T().Skip("skipping test in short mode")
 	}
-	handler, err := NewWebauthnHandler(&test.DefaultConfig, s.Storage, s.GetDefaultSessionManager(), test.NewAuditLogger())
+	handler, err := NewWebauthnHandler(&test.DefaultConfig, s.Storage, s.GetDefaultSessionManager(), test.NewAuditLogger(), nil)
 	s.NoError(err)
 	s.NotEmpty(handler)
 }
@@ -48,7 +48,7 @@ func (s *webauthnSuite) TestWebauthnHandler_BeginRegistration() {
 
 	userId := "ec4ef049-5b88-4321-a173-21b0eff06a04"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	sessionManager := s.GetDefaultSessionManager()
 	token, err := sessionManager.GenerateJWT(uuid.FromStringOrNil(userId))
@@ -89,7 +89,7 @@ func (s *webauthnSuite) TestWebauthnHandler_FinalizeRegistration() {
 
 	userId := "ec4ef049-5b88-4321-a173-21b0eff06a04"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	sessionManager := s.GetDefaultSessionManager()
 	token, err := sessionManager.GenerateJWT(uuid.FromStringOrNil(userId))
@@ -135,7 +135,7 @@ func (s *webauthnSuite) TestWebauthnHandler_FinalizeRegistration_SessionDataExpi
 
 	userId := "ec4ef049-5b88-4321-a173-21b0eff06a04"
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	sessionManager := s.GetDefaultSessionManager()
 	token, err := sessionManager.GenerateJWT(uuid.FromStringOrNil(userId))
@@ -170,7 +170,7 @@ func (s *webauthnSuite) TestWebauthnHandler_BeginAuthentication() {
 	err := s.LoadFixtures("../test/fixtures/webauthn")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 	req := httptest.NewRequest(http.MethodPost, "/webauthn/login/initialize", nil)
 	rec := httptest.NewRecorder()
 
@@ -194,7 +194,7 @@ func (s *webauthnSuite) TestWebauthnHandler_FinalizeAuthentication() {
 	err := s.LoadFixtures("../test/fixtures/webauthn")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	body := `{
 "id": "AaFdkcD4SuPjF-jwUoRwH8-ZHuY5RW46fsZmEvBX6RNKHaGtVzpATs06KQVheIOjYz-YneG4cmQOedzl0e0jF951ukx17Hl9jeGgWz5_DKZCO12p2-2LlzjH",
@@ -247,7 +247,7 @@ func (s *webauthnSuite) TestWebauthnHandler_FinalizeAuthentication_SessionDataEx
 	err := s.LoadFixtures("../test/fixtures/webauthn")
 	s.Require().NoError(err)
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	body := `{
 "id": "4iVZGFN_jktXJmwmBmaSq0Qr4T62T0jX7PS7XcgAWlM",
@@ -279,7 +279,7 @@ func (s *webauthnSuite) TestWebauthnHandler_FinalizeAuthentication_TokenInHeader
 
 	cfg := test.DefaultConfig
 	cfg.Session.EnableAuthTokenHeader = true
-	e := NewPublicRouter(&cfg, s.Storage, nil)
+	e := NewPublicRouter(&cfg, s.Storage, nil, nil)
 
 	body := `{
 "id": "AaFdkcD4SuPjF-jwUoRwH8-ZHuY5RW46fsZmEvBX6RNKHaGtVzpATs06KQVheIOjYz-YneG4cmQOedzl0e0jF951ukx17Hl9jeGgWz5_DKZCO12p2-2LlzjH",
diff --git a/backend/handler/well_known_test.go b/backend/handler/well_known_test.go
index 7fe1c3ce94..c19af2191e 100644
--- a/backend/handler/well_known_test.go
+++ b/backend/handler/well_known_test.go
@@ -22,7 +22,7 @@ func (s *wellKnownSuite) TestWellKnownHandler_GetPublicKeys() {
 		s.T().Skip("skipping test in short mode")
 	}
 
-	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil)
+	e := NewPublicRouter(&test.DefaultConfig, s.Storage, nil, nil)
 
 	req := httptest.NewRequest(http.MethodGet, "/.well-known/jwks.json", nil)
 	rec := httptest.NewRecorder()