add automatic logout to HttpMiddleware & tests