configure middleware
add test for session inactive timeouts