express middleware, close #3