pg 161 -- session middleware