reasonable session solution with middleware