commented out session authentication middleware