Simple cookie-based session middleware