So the problem here is that you create a regular user, but not a "nova" user. You're logged in as this person, but it seems that it doesn't have access to nova itself, therefor you get the 403.
So are you sure the check in nova for who has access to nova itself is matching with the roles you assign this specific user?
The reason why it works without middleware is because there is no extra check anymore if your user can access the site or not. However all checks are disabled, so not an ideal situation!