moved custom express middleware into lib/middleware
created middleware to redirect to app if logged in

but not if the user is trying to destroy the session