We need middleware to deal with the username being missing on session (i.e, we'd need to error).