add cookie and session middleware