added middleware for session expiration