update README: requires a session middleware