fix session max age to one week
routes and middlewares in separate folders