[#5] added session middleware, store key in req.session.key