default now 303 redirect, not 302. Something like auth (looks like sessions, yep, but this is my auth) middleware, also res.cookie(), decodeURI, mime middlewares.