update middewares to fix session setCookie twice error