custom session middleware for json cookie