move session into its own middleware