don't use session middleware due to cookie domain issues