Middleware for flags

fao @commuterjoy @wheresrhys 
How come we need to process the cookie? Doing this will invalidate pretty much any caching we have in place, so it's best avoided.