add middleware: csrf / compression / error handler