session middleware with login mechanism