remove session related middleware

that's browser related, we always use API tokens