Add middleware to secure URL : check user in session when it's needed