first pass at redirect follower middleware

includes it, but not enabled by default
closes #246