add session middleware