Add `test` middleware to README.

Also, make session binding the outermost form in all `test` middleware handlers for clarity.