Re-organize the middleware chunks for organization's purpose.
Validate the signature on the JWS tokens.
Track notBefore in order to provide application-wide logout.
Move to using Sessions to track auth, instead of cookies
  (bring cookies back tomorrow)