update session middleware