fixed a bug with the auth middleware, made session middlewares required