Add test to check that middleware does not clobber session data set by handler
Preserve session set in request if none set by response handler