Your middleware must return a Response object, or $next($request). As written, 
when not logged in or when $empl is empty, your middleware is just returning a 
string, not a redirect. Update your returns to:

return route('login');
to
return redirect()->route('login');

respectively.