rewriting Session stuff as a helper not a middleware