connect/express-style session middleware for apps that don't use connect/express