move session middleware to 1st