Move session middleware into own module