move session and route to middlewares