turn off sessions and protection middleware by default