Express middleware that enforces a single session per user