use middleware instead of ActionController filters

this allows flip to be used in routes. If setup of host/session etc is
done with ActionController filters, then they won't be available
otherwise, and we get weird non-deterministic behaviour when class
level variables stick around after request finishes