move static files middleware before session

This change implements the suggestion in issue #318.