always include cylon as the very first middleware

Closes #2