user middleware to ensure session