session as middleware