use call_user_func over $callback(), add tests
add scrutinizer config
fix session middleware