use a two-pass system for composing app middleware; minor cleanup