use session middleware
add some play rules