Make middleware thread-safe, closes #68

The thread-safety issue manifested itself as two separate requests
receiving the same environment further down the middleware chain. As
a result, two different URLs could yield the exact same response.
Merge branch 'thread-safety'