fix session middleware