Update app.js

- Fixed order of middleware (session is required before index is served or the cookie is not set in time)
- Fix cookie parsing: use `cookieParser.signedCookies(cookie.parse(headers));` or `cookieParser.signedCookie(cookie.parse(header).sid);`.
- Better error handling
- Must call next() when session is retrieved